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Executive Summary 

Since the loss of Columbia on February 1, 2003, the Space Shuttle Program (SSP) has 
significantly improved the understanding of launch and ascent debris, implemented hardware 
modifications to reduce debris, and conducted tests and analyses to understand the risks 
associated with expected debris. The STS- 1 14 flight rationale for expected debris relies on a 
combination of all three of these factors. 

A number of design improvements have been implemented to reduce debris at the source. The 
External Tank (ET) thermal protection system (TPS) foam has been redesigned and/or process 
improvements have been implemented in the following locations: the bipod closeout, the first 
ten feet of the liquid hydrogen (LFB) ta nk protuberance air load (PAL) ramp, and the LFE tank- 
to-intertank flange closeout. In addition, the forward bipod ramp has been eliminated and 
heaters have been installed on the bipod fittings and the liquid oxygen (LO 2 ) feedline forward 
bellows to prevent ice formation. The Solid Rocket Booster (SRB) bolt catcher has been 
redesigned. The Orbiter reaction control system (RCS) thruster cover “butcher paper” has been 
replaced with a material that sheds at a low velocity. Finally, the pad area has been cleaned to 
reduce debris during lift-off. 

The understanding of the sources and mechanisms that produce foam debris was established by a 
rigorous root cause investigation and the dissection of significant sections of foam removed from 
flight-ready ETs. Quantifying the risk associated with debris has been a major challenge. 
Activities included tests and analyses to predict expected/possible debris, transport tests and 
analyses to define debris trajectories and the velocity at impact, and tests and analyses to 
determine the impact capability of the Orbiter TPS components. These tests and analyses have 
addressed all types of ET foam and tank locations, ice from several locations on the ET, and 
butcher paper from the RCS thruster cover. 

The SSP requested that the NASA Engineering and Safety Center (NESC) conduct a peer-review 
of the flight rationale for expected debris. The NESC assembled a multi-disciplinary team of 
subject matter experts to address each component of the proposed flight rationale. The team 
reviewed the debris sources data, transport test and analysis data, Orbiter impact capability test 
and analysis data, and the overall methodology to establish flight rationale and associated risks. 
The NESC peer-review began with the element level certification activities in 2004 and 
continued through the development of the end-to-end Space Shuttle System (SSS) level flight 
rationale in 2005. The NESC team has been working closely with the SSP team and has 
provided numerous recommendations throughout the review process on possible areas of 
improvement to the foam spray process, hardware redesign, and in quantifying the risks 
associated with expected debris. Virtually, all of the NESC recommendations have been 
implemented by the SSP team. This report documents the findings of the NESC peer-review of 
the flight rationale logic and conclusions. (Previously issued NESC position papers documented 
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the findings and recommendations regarding element level certification for expected debris). 
Provided below is a summary of the NESC findings for the principle elements of the flight 
rationale. The conclusions and recommendations are highlighted. 

Physics of Foam Debris Generation: Each foam location on the ET has been assessed for 
susceptibility to large foam loss based on physical arguments about the type of foam, and the 
void temperature and pressure conditions during ascent. The large acreage locations, where the 
automated spray method is used, were eliminated from concern since no voids were found in 
these areas during dissection of foam on ta nk ET-94. Other locations can contain voids which 
have leak paths and may be susceptible to cryoingestion or cryopumping, depending on their 
location on the ta nk and the thickness of the foam. Divoting from sealed voids due to 
thermal/vacuum conditions is the most likely source of foam debris and can occur in every 
location on the ta nk with manually applied foam. The NESC concluded that an analysis of 
each specific location on the tank that takes into account the local temperature, pressure, 
and location of voids is a valid method for determining the most likely divoting mechanism 
for each ET foam debris case. 

“Worst-on-Worst (WOW) Estimate” of the Impact Capability Margin (C/E): The WOW 

estimate of the C/E is actually the certification rigor methodology for structural design. C is the 
capability of TPS to survive the impact and E is the debris environment, both quantified in 
kinetic energy (KE) for impacts to the RCC and velocity for impacts to tile. The WOW estimate 
includes a 1.4 factor of safety (FOS) on C and a 1.25 FOS on E. The methodology compounds 
conservatisms that are included in each of the three analyses (debris liberation, debris transport, 
and impact capability) that must be combined to estimate the C/E. The minimum predicted 
impact C/E is well less than 1 .0 for many WLE RCC panels, the RCC nose cap and chin panel, 
and many tile locations. Therefore, the locations of the Orbiter with a C/E less than 1.0 are 
not certified for expected debris using the standard WOW approach. To further address 
these locations, a “best estimate” approach was used to compute a less conservative estimate of 
the C/E. In addition, a Monte Carlo-based probabilistic analysis was used to quantify the risk for 
the most difficult cases. 

“Best Estimate” of the Impact Capability Margin (C/E): The “best estimate” is a quasi- 
deterministic method. The capability and expected debris mass are point-values; and the debris 
transport analysis is the result of a Monte Carlo simulation. All FOSs used in the certification 
methodology are removed from the estimates of C and E. In addition, the expected debris mass 
has been reduced to the smaller mass debris due to the sealed voids divoting mechanism. The 
NESC concurs that the “best estimate” method is less conservative than the “WOW estimate” 
and is useful in understanding the level of risk due to expected foam debris. The system level 
FOS should be at least 1.4, if all other FOSs are removed from the C and E estimates. A 
number of debris cases for RCC and tile do not have an impact C/E greater than 1.4 based 
on the “best estimate” method and several locations are below 1.0. 
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Recommendation #1: The NESC concurs with the Delta System Design Verification Review 
(DVR) (April 26-27, 2005) finding that an end-to-end Monte Carlo-based probabilistic 
analysis will be conducted for the foam debris cases that do not have a “best estimate ” impact 
C/E of at least 1.4. 

ET Foam Debris Environment (E): The cryopumping and cryoingestion divoting mechanisms 
are included in the “WOW estimate”, but not included in the “best estimate” of the debris mass. 
Divoting from cryopumping requires a “smart” leak path that is large enough to allow a void to 
fill with condensed air during the pre-launch hold, but is small enough to preclude venting as the 
air is vaporized during ascent. The results of component level tests simulating the flight 
environment support the supposition that divoting from cryoingestion and cryopumping are 
highly unlikely to occur. Therefore, the “best estimate” values of E are based on the smaller 
mass, but more likely debris caused by the sealed void divoting mechanism. The NESC concurs 
with the logic of not including cryoingestion and cryopumping in the “best estimate” of E used in 
the impact C/E because this is a quasi-deterministic method. However, all divoting mechanisms 
and all void data must be included in the Monte Carlo-based probabilistic analysis. 

Recommendation #2: Cryoingestion should be included in the Monte Carlo-based 
probabilistic analysis of the debris cases that do not satisfy the system level “best estimate ” 
impact C/E of at least 1.4. 

Impact Capability (C) for RCC: The value of impact capability that corresponds to the onset 
of damage in RCC (or the Non Destructive Evaluation (NDE) threshold for detectable damage) 
is a requirement, and should not be thought of as a knockdown factor to account for an 
uncertainty. The damage onset requirement was established by the arcjet bum- through tests and 
the analysis of the WLE and nose cap. The SSP based the “best estimate” value of C on only the 
as-fabricated properties of the RCC test panels. The NESC reviewed the engineering data and 
concluded that the value of C used in the “best estimate” must account for both expected material 
variability and end-of-life aged RCC. Therefore, the NESC computed values of the “best 
estimate” impact C/E are approximately 20 percent lower than the SSP values. In addition, 
the nose cap geometry and material are significantly different from the WLE RCC panels. No 
impact tests or arcjet burn-through tests have been conducted on the nose cap geometry or 
material. The impact capability margins (estimated to be less than 1.0) for the nose cap and 
chin panel are based only on analytical results from math models that have not been 
verified to be accurate for the nose cap geometry and material. 

Recommendation #3: The “ best estimate” value of C should be computed using material 
properties that accounts for material variability inherent in RCC and the end-of-life aged 
RCC properties. 
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Recommendation #4: Impact tests and arcjet tests should be conducted on the nose cap 
geometry and material to verify the analysis methodology and results used to develop the flight 
rationale. 

RCC Burn-Through and Hole Growth Damage Requirements: After reviewing the 
engineering data supporting the RCC burn-through requirements and the RCC Damage Growth 
Tool used to develop the nose cap and WLE damage maps, the NESC concurs that the arcjet data 
is adequate to establish the RCC impact damage requirement for re-entry of STS-1 14 (0.020" 
coating loss for time to breach, and 0.020" coating loss plus a mid-plane delamination for hole 
growth). However, the experimental data from the stagnation flow arcjet tests are not sufficient 
to validate the tool for all impact damage cases and for vehicle locations subjected to crossflow 
flight conditions. Stagnation flow arcjet tests are a reasonable simulation of the nose cap flow 
conditions whereas properly designed wedge flow arcjet tests are a better simulation of the 
crossflow flight conditions of the WLE. Therefore, the level of conservatism, uncertainty in 
results, and limitations on the use of the tool cannot be established for all vehicle locations and 
damage cases. Because of this shortcoming, the current tool should only be used by experienced 
subject matter experts such as the tool developers. Specifically, caution must be exercised in 
using this tool to predict hole growth. 

Recommendation #5: Additional arcjet tests with specimens containing actual impact damage 
rather than simulated impact damage, particularly wedge flow tests, are required to establish 
the level of conservatism in using the RCC Damage Growth Tool for all vehicle locations and 
impact damage cases. 

Past Flight History: The data on debris generation and impact damage recorded from previous 
flights provides a compelling basis for a flight rationale for Orb iter acreage tile. However, it has 
less relevance for impacts on the Orbiter RCC. The recorded incidents of foam debris generation 
are documented from a limited number of cameras. So this information lacks the fidelity 
required to precisely define the debris mass. Also, a large database (about 14,000 cases) of 
actual damage to tile has been recorded over the life of the Orbiters. A subset of about 300 
damage cases, referred to as the platinum dataset, are adequately documented to provide a 
benchmark for the computational methodology developed to predict tile damage. The NESC 
concluded that the platinum dataset is also a valid basis for supporting the flight rationale. 

Tile and Structural Capability Models: A suite of Math Model Tools (Damage, Aerothermal, 
Thermal and Structural Analysis Tools) are utilized to describe the capability of the acreage 
Orbiter tile and structure. This description of capability is documented as a “damage map” and 
is utilized in various forms and versions throughout the flight rationale. The tools have been 
subjected to peer-review to understand the basic workings of all tools, assumptions, limitations 
and key parameters passed between the tools. The methodology, used in the production of the 
“certification rigor” or “1 st generation” damage map, incorporates all the standard certification 
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rigor methodologies and factors. Therefore, the conservatism of the capability established is 
believed to be quite high. 

Recommendation #6: Certification of tools for both in- flight and as a part of the flight 
rationale should include a thorough end-to-end validation. This validation should emphasize 
interfaces between tools, demonstrating understanding of modeling accuracy and uncertainty, 
as well as end-to-end correlation to both test and historical damage. 

Recommendation #7: The generation of a less conservative, predictive damage map should be 
produced for quantification of pre-flight risk of tile acreage catastrophic damage and 
compared to flight history for the purposes of model validation. 

Flight Rationale for Tile: Both the “WOW” and “best estimates” of the impact C/E for many 
tile locations are considerably less than 1.0. However, the Math Model Tools used to estimate 
these impact C/Es also conservatively overestimates the severity of some damage cases 
previously recorded in the flight history database. Flight history clearly illustrates the damage 
tolerance capability of acreage tile. Therefore, a flight rationale has been constructed which 
gives increased confidence in our understanding of the debris environment and indicates that for 
typical debris there is not a catastrophic hazard for foam impacts on tile (excluding seals and 
penetrations). However, the use of flight history is not sufficient to characterize the accepted 
risk if several cases of severe impact damage occurring in a noncritical tile location had occurred 
to a more critical close-by tile location. 

Recommendation #8: A Monte Carlo-based probabilistic analysis that includes the 
distribution of foam defects as well as the Monte Carlo debris transport analysis should be 
conducted to determine the likelihood of an impact which exceeds the tile damage tolerance 
capability. 

Risk Assessment for Foam Debris: The Aerospace Corporation has conducted Monte Carlo- 
based probabilistic analyses of the most severe foam debris sources (LCE ice/frost ramp, LO 2 
intertank flange, LH 2 intertank flange, LO 2 PAL Ramp, and Bipod Closeout). The Aerospace 
Monte Carlo-based probabilistic model used methodologies that have been peer-reviewed and 
validated by comparison to other analysis results and ground test data. In addition, the input 
distributions used in the analyses have also been peer-reviewed. While the end-to-end 
predictive capability (numerical results) has not been verified, the results of sensitivity 
studies and comparison to flight data suggest that the results are conservative. Based on the 
results of these analyses and an assessment of the controls for each foam source, the NESC 
concurs with the SSP that the likelihood of debris from each foam source exceeding the critical 
impact capability for RCC is Improbable. The NESC concurs with the SSP that the likelihood of 
foam debris exceeding the critical impact capability of Tile is either Remote or Infrequent, 
depending on the foam source. The highest computed risk is for tile seals and penetrations, 
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which is not overly conservative relative to flight history, and furthermore, has not been fully 
characterized. The NESC has concluded that the probabilistic results, supplemented by 
additional engineering data, physics considerations, and the level of control over debris 
liberation, provide a reasonable engineering foundation for a flight rationale for STS-114 
based on accepted risk due to expected foam debris. 

Recommendation #9: The risk assessment for seals and penetration should be completed, 
including the threat from popcorning foam debris and ice debris. 

Risk Assessment for Ice Debris: The Boeing Company has conducted Monte Carlo-based 
probabilistic analyses of ice debris from the ET feedline bellows at the forward, mid and aft 
locations and the ET feedline brackets at locations 1 129 and 1377. (Ice and baggie debris from 
ET umbilicals has not been rigorously analyzed). While ice liberation tests of a feedline bracket 
have been conducted, the limited results do not provide an adequate test basis for building 
distributions of the debris mass. Furthermore, limitations in simulating the actual flight 
environment cast a doubt over the suitability of the test results to establish the time of release of 
the ice debris. Therefore, several different distributions of mass debris and several scenarios of 
time of release were used to estimate the probability of ice debris exceeding the Orbiter critical 
impact capability. A less conservative tile damage capability allowable (50 percent damage 
depth) was used in the ice analysis than the foam analysis. (This is unacceptable for 
deterministic analyses). The results indicate that the estimated likelihood of exceeding the 
critical damage capability for the RCC is Improbable. The estimated likelihood of exceeding the 
critical damage capability for tile is very high (Probable or Infrequent). (Seals and penetrations 
were not explicitly addressed in the probabilistic analyses). Flowever, the Monte Carlo analysis 
results vary by three orders of magnitude, depending on the input mass distribution assumption 
and the scenario for time of release, which could result in the risk being classified anywhere 
from Probable to Remote. In addition, a relative comparison between the bellows ice liberation 
test and the bracket ice liberation test suggests that significantly more ice is liberated from the 
bellows than from the bracket. Therefore, a reasonable qualitative argument can be advanced 
that eliminating the bellows ice has significantly lowered the overall risk to tile from ice debris. 
Based on the available test data and analysis results, the NESC has concluded that the 
feedline brackets, bellows, and ET umbilical ice debris environment is not sufficiently 
characterized or understood to assign the level of risk. To establish the flight rationale for 
STS-114, additional work is required to develop adequate controls for ice. 

Recommendation #10: A physics-based engineering analysis of the risk to tile from ET 
umbilical ice and baggie debris should be conducted to ensure that adequate impact capability 
exists for impact scenarios consistent with past flight environment. 

Recommendation #11: An evaluation of effective controls of ice debris front the ET umbilical 
ice should be completed prior to STS-114 and implemented via Launch Commit Criteria 
(LCC). 
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Recommendation #12: An evaluation of effective controls of ice debris from the feedline 
brackets should be completed prior to STS-114 and implemented via Launch Commit Criteria 
(LCC). In addition, risk mitigation methods that can be implemented for subsequent missions 
to reduce overall program risks should be pursued as a high priority. 

Recommendation #13: Focus the flight test objectives to obtain engineering data during STS- 
114 to characterize the ice debris environment for the ET feedline brackets at locations 1129 
and 1377, mid bellows, and ET umbilical. Additional ground tests should be conducted to 
supplement the flight test data. 

Recommendation #14: The end-to-end predictive capability of the Boeing and Aerospace 
probabilistic analysis codes, which were independently-developed, should be verified. One 
approach to achieving this verification is to compare the analysis results from the two codes 
for at least one debris case. 
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1.0 Introduction and Background 

1.1 Introduction 

Recent work completed by the Orb iter Project Office (OPO) engineering team and the External 
Tank (ET) Project engineering team indicates that the SSS cannot be fully certified for flight 
through expected foam or ice debris liberation from the ET. The certification strategy included 
conservative assumptions for uncertainties in loads, material properties, and analysis methods 
that are incumbent in the engineering standard practice for designing human space flight vehicle 
systems. This approach, referred to as the “WOW” estimate of system capability, compounds 
conservatisms, and therefore, represents a potentially unrealistic estimate of the actual system 
capability. The WOW estimates indicated that the system impact capability for expected debris, 
measured by the ratio of Orbiter impact tolerance “capability” (C) divided by the expected debris 
(foam or ice) “environment” (E), resulted in C/E ratios less than one for some Orbiter locations. 
In response to these results, the SSS has revised the end-to-end certification strategy from 
Certification to Accepted Risk. The Accepted Risk strategy will be based on “best estimates” of 
C and E in areas where the WOW estimate does not provide C/E greater than one. In addition, 
Monte Carlo-based probabilistic analyses will be conducted to estimate the risks for the most 
severe cases of foam and ice debris. Space Shuttle Systems Engineering and Integration (SE&I) 
will be developing the flight rationale for the Accepted Risk strategy. Mr. John Muratore 
requested that the NESC conduct an independent peer-review of the flight rationale. 

The NESC assembled a team of subject matter experts with knowledge of ET foam debris 
generation, debris transport analysis, Orbiter TPS tile and WLE RCC impact damage capability, 
and system level risk assessment tools. This team reviewed the following elements: 

• Flight rationale logic. 

• Available engineering data to support the flight rationale. 

• Methods to determine the likelihood and “best estimate” of the debris impact mass. 

• KE, impact tolerance of the Orbiter TPS tile, and RCC. 

• Characterization of risks. 

The Findings, Conclusions, and Recommendations of the peer-review are documented herein. 

1.2 Background 

An end-to-end strategy has been developed for certifying the SSS for expected debris. Using the 
definitions developed by the SE&I, expected debris is defined as debris generated by the vehicle 
that is inherent in the system design. Shuttle System certification verifies and validates that the 
SSS can fly through the expected debris environment without any change to configuration or 
capability. The end-to-end strategy consists of three interrelated parts and is discussed in the 
following paragraphs. 
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1 . Capability/Environment (C/E) ratio to define the system capability margin for certification. 

2. Hierarchical approach to system certification and/or developing a flight rationale. 

3 . V erific ation and V alidation ( V& V) . 

Impact tolerance C is defined as the ability of a specific element (Orbiter WLE, tiles, windows, 
etc.) of the SSS to withstand an impact without change to capability or configuration. The 
expected debris E is defined as the debris generated from any system element and transported to 
impact into a specific element with capability C. Both C and E are currently defined in terms of 
KE for RCC. Depth of damage is used for acreage tile. For certification purposes, capability is 
the allowable impact KE for the element and environment is the actual (predicted) impact KE of 
the debris. Therefore, the C/E ratio, determined for each element in the system, has the potential 
to define the actual or true capability margin possessed by the SSS. The C/E ratio must also 
include all uncertainties and dispersions. An uncertainty is accounted for by using bounding 
values of a parameter without the knowledge of its distribution. Dispersions are defined as the 
known distribution of values about a mean value of a parameter. The SSP has adopted a value of 
1.5 for “best estimate”, chosen at the SSS level, and 1.0 for WOW as required values of C/E. 

A hierarchical approach to developing an acceptable flight rationale includes three levels for 
system certification and two additional levels for a flight rationale if the system cannot be 
certified as possessing adequate impact tolerance capability. These five levels are as follows: 

1 . Prove that there is no expected debris. (Certified) 

2. The C/E ratio is acceptable for the "WOW" case analysis. (Certified) 

3. The impact tolerance capability (C) is not exceeded by the debris environment (E) using a 
Monte Carlo analysis of the dispersions; and, C/E is greater than 1.5, chosen at the SSS 
level. (Certification is not demonstrated. The flight rationale is based on accepted risk). 

4. The flight rationale is Accepted Risks based on realistic estimates of impact capability, 
including an engineering assessment of the physics of each debris source. Relevant flight 
history data and engineering data such as the reduced void (defect) count for the new 
redesigned foam will also be used to develop the flight rationale. (Certification is not 
demonstrated. The flight rationale is based on accepted risk). 

5. Use other risk acceptance approaches such as damage tolerance and Monte Carlo-based 
probabilistic analyses of debris cases that do not satisfy any of the four previous levels. 
(Certification for impact damage capability is not demonstrated and risks are quantified. 
The flight rationale is based on adequate damage tolerance to complete the mission). 

The SSP is implementing a plan to verify and validate the end-to-end certification process. The 
SE&I defined verification as the determination that an element meets requirements. Validation 
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is defined as the determination that the system meets top level requirements in the operational 
environment, models reflect the real world, and that software requirements are correct. Three 
primary technical elements comprise the determination of the C/E ratio — debris generation, 
debris transport, and impact tolerance capability. A comprehensive test program is being 
implemented to verify and validate each of the three technical elements. However, 
computational tools must be used to link together analytically the three elements because a 
system level test is not possible. Therefore, V&V must also include the computational tools and 
models. 


NESC Request No. 05-010-E 


@ 

NASA Engineering and Safety Center 
(NESC) Technical Assessment Report 

Document #: 

RP-05-82 

Version: 

1.0 

Title: 

NESC Peer-Review of the Flight Rationale for Expected 

Debris Report 

Page #: 

18 of 148 


2.0 The 0.0002 lbm Debris Threshold 

2.1 Assessment of Engineering Data 

1 . There are 60 debris sources which have been cleared on the basis of being less than a 

0.0002 lbm threshold. This family of debris sources was segregated based on being an 
order of magnitude less than “best estimates” for other debris sources. 

2. The analysis of this type of debris was limited to assuming the maximum drag rapidly 
drives the velocity of the debris to zero while the vehicle is assumed to be traveling at the 
maximum free stream velocity of approximately 4000 fps. This results in a KE at impact 
of less then 30 ft-lb, which is significantly below any kn own damage tolerance to the 
vehicle. 

3. These debris sources were considered a much lower priority than larger debris, and the 
ability to test these mass velocity combinations was characterized as “impossible”. 

4. This family of 60 debris cases is classified as remote/catastrophic on the risk matrix. 

2.2 Limitations and Gaps 

1 . There is limited analysis and no test to support this rationale. The velocity of 4000 fps 

may bridge low velocity impact and hyper velocity impact and, therefore, KE comparison 
may no longer be valid. 

2. There is a wide diversity of debris types and sources under the 0.0002 lbm threshold. 
Including all of these in one block of the risk matrix, makes it difficult to establish the 
true risk, or to identify the one or two critical debris source/target pairs. 

2.3 Implications and Conclusions 

1 . There is uncertainty associated with the lack of analysis and test for these small particles. 
While the engineering data is insufficient to clear these items, the NESC concurs with the 
SSP’s prioritization and risk characterization. 

2.4 Recommendations 

1 . Represent the 60 debris source/target pairs as a distribution on the risk matrix with those 
that push the risk into the catastrophic consequence column explicitly identified. 

2. Assess additional testing or hydrocode analysis to ensure smaller particle sizes in these 
higher velocity regimes are not a threat. 
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3.0 Foam Debris from the External Tank 

3.1 Assessment of Engineering Data 

1 . An extensive database of voids has been assembled from dissected foam from previously 
sprayed tanks, primarily ET-94, and from numerous high-fidelity witness panels sprayed 
using the new manual spray method. The database includes voids found in all types of 
foam used on ET-120/ET-121. 

2. An ET Project investigation identified cryoingestion as the most probable root cause of 
the debris liberation observed in flight history data for the LH 2 tank-to-intertank flange 
location. The critical region of the flange has been redesigned, including a significantly 
improved manual spray process. Based on the dissection data from witness panels, the 
new spray process yields foam with far fewer voids and smaller voids than were recorded 
in the dissection data for the old foam. In addition, component panels with the geometric 
features of the LH 2 intertank flange joint and loads representative of the vehicle flight 
environment were tested and did not exhibit divots due to cryoingestion. (Reference: 

Test Report 809-9630, “Flaw Tolerance of Enhanced Flange Closeout”, Lockheed Martin 
Space Systems Company, 04/15/2005). 

3. An extensive database has been generated to describe the cohesive failure of foam due to 
thermal vacuum, cryopumping, and cryoingestion conditions. A failure methodology 
based on principles of fracture mechanics has been developed and verified through a 
comprehensive test program. 

3.2 Limitations and Gaps 

1 . The dissection data from ET-94 is not sufficient to establish LH 2 tank-to-intertank 
variability of manually sprayed foam that was not removed from ET-120/ET-121. 

2. BX-250 is the predominate manually sprayed foam for tanks produced through ET-120. 
After ET-120, the manually sprayed foam is BX-265. BX-265 replaced BX-250 due to 
environmental issues with the blowing agent in BX-250. BX-265 is being applied in all 
redesign/rework areas. ET-94 was set aside as a dissection/test article, therefore, most of 
the dissection data for comparison with “as-built” manually sprayed foam is BX-250 
(overall about 75 percent of the process defects in the dissection data in ET Report 809- 
9440 are BX-250). Whether defect process yield from BX-250 foam is comparable to 
BX-265 foam has not been established. A simple comparison of all process defects from 
the dissection database reveals a greater percent of larger defects in the BX-265 than the 
BX-250 samples. For cylinders, 8 percent of the defects have a length greater than 1-inch 
in the BX-265 sample, whereas 4 percent are greater than 1-inch in the BX-250 sample. 
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For slots, about 7 percent of the width of the defects is greater than 0.5 inches in the BX- 
265 sample, whereas 4 percent are greater than 0.5 inches in the BX-250 sample. The 
chemical composition of BX-265 was modified in the attempt to maintain similar 
handling characteristics as BX-250, such as rise-time and overlap time. The foams are 
applied at distinct component temperatures — BX-250 around 1 10° F and BX-265 at 
about 155° F. A limited number of thermal vacuum test panels were fabricated using the 
discontinued BX-250. The divoting of these panels is enveloped by the results from the 
testing with BX-265. 

3. Statistical analysis of data by the NESC shows that neither the 1 .4 times “max observed” 
estimate nor the 99 th percentile Nonnal distribution estimate of the “max expected” is a 
bounding estimate. The fits were made to the truncated dataset, i.e., no voids below the 
dissection recording limit, and this effect was not accounted for in the fit. 

4. The "foam end-to-end best estimate" is not really end-to-end. It is another C/E study 
with most FOS and larger conservatisms removed. A better idea of total risk could be 
derived from a study that probabilistically combines all factors with uncertainties that 
reflect the state of knowledge on each factor. To really be "end-to-end", such a study 
should include the probability of releasing a large piece of foam and the probability of the 
foam hitting a critical area. 

5. The limited test data at the smaller void depths and smaller void sizes is insufficient to 
accurately define the divot/no-divot failure curve. Also, the cases of replicate tests are 
insufficient to characterize material level data scatter. The divot/no-divot failure curve is 
used more like the design allowable in a limit load stress analysis than a fracture 
toughness value in a damage tolerance analysis. Therefore, uncertainties in material 
variability and data scatter should be treated like the development of “A” basis design 
allowables. 

3.3 Assessment of Foam on RCC Environment (E) “Best Estimate” Logic 

1 . Calculating “E”, the foam on RCC environment, is a multi-step analysis: 

a. Determine “best estimate” ET void defect size. 

b. Notionally place defect at maximum depth that will result in a divot using ET 
provided divot/no divot curves - constrained by the maximum foam depth. 

c. Calculate divot volume assuming divot is a frustum. 

d. Determine maximum KE impact from Monte Carlo analysis of density variation 
and Debris Transport Analysis (DTA). 
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2. The “best estimate” analysis selected an ET foam insulation defect size. For the most 
part, this was the maximum of the following three elements: 

a. Maximum defect observed from dissection data. 

b. 99 percentile of a Weibull distribution fit to the dissection data. 

c. 99 percentile of a Normal distribution fit to the dissection data. 

There were exceptions to this rule and, in at least three cases, the defect size used in the 
“best estimate” was less than the maximum observed in the dissection data. Based on 
this “quasi-deterministic” method of computing a “best estimate” using a defect value 
less than the maximum observed is not supportable. However, an alternative and 
potentially less conservative approach is to conduct a Monte Carlo-based probabilistic 
analysis using a distribution of defects. 

3. Only process defects were considered. Geometric defects were not considered as their 
depth was too deep for a divot to form. This assumption has been verified. 

4. The divot thicknesses were calculated using the “Limit” divot/no-divot curves. “Limit” 
curves include a 0.9 material knockdown factor, but the 1.25 FOS was removed. (The 
knockdown factor of 0.9 has been confinned to be appropriate based on fracture 
toughness test results. Also, the adjustments to the BX-265 “Limit” divot/no-divot curve 
for NCFI-24-124 and PDL 1034 foams have also been demonstrated to be appropriate 
based on fracture toughness data). Using the “Limit” divot/no-divot curve rather than the 
ultimate curve with the 1.25 FOS is acceptable for determining the “best estimate” value 
of E. However, the system level FOS (C/E) should be at least greater than 1.4. 

5. The values used for KE were the maximum values from the debris transport Monte Carlo 
analysis. 

6. The “best estimate” value of E assumes an ET foam defect will cause a divot, the divot 
will always be aerodynamically transported to the Shuttle, and the divot will always hit 
the Shuttle on the apex of the RCC. 

7. The “best estimate” value of E is based on the sealed void divoting mechanism. The 
cryoingestion and cryopumping mechanisms are included in the certification rigor 
estimates of C/E, but are not included in the “best estimate”. 
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3.4 Engineering Assessment of Physical Realism of Debris Sources 

The ET Project has considered three divoting mechanisms: 

1 . Cryoingestion-induced divoting. 

2. Cryopumping-induced divoting. 

3. Sealed void divoting. 

Cryoingestion-induced divoting is limited to the LTE/intertank flange area where foam voids at 
the substrate can communicate with the intertank N 2 purge gas. Cryopumping-induced divoting 
has been assessed for locations on the ta nk where the substrate is cold enough to allow the 
condensation of air (the LH 2 tank) and where it reaches a temperature of at least -320°F during 
the first 130 seconds of ascent (the first barrel of the LH 2 tank). Cryoingestion and cryopumping 
divoting use the same divot/no-divot curve to assess the divot mass and critical void size. 

Sealed void divoting is ameliorated by low local temperatures that reduce the void pressure 
(increasing the critical defect size). 

A fourth divoting mechanism not considered by the ET Project, "air enrichment" divoting, can 
also occur. Here, the void temperature during tanking is not cold enough to condense ambient 
air, but is cold enough to concentrate the air in a venting void. The vent must be sized to act as a 
highly resistive leak in the correct size range. That is, it allows air to leak into the void (due to 
temperature induced pressure differences) over the 6-hour time period prior to launch that the 
tank is at cryogenic temperatures, but not allow any appreciable amount of air to leak back out of 
the void during the ascent. The worst case condition prior to launch will be air at 1 atmosphere 
(atm) and sub-ambient temperature. If the leak path size is in the correct range, increases in the 
void temperature during ascent could result in void pressures well above 1 atm. Even if the void 
temperature does not increase during the critical foam release period (80< Mission Elapsed Time 
(MET) <130 seconds), a leak path size in the correct range could result in a void pressure 
approaching 1 atm during ascent. 

An examination of each of the foam debris source locations on the ET and their possible divoting 
mechanisms is provided below: 

LO 2 Tank Acreage (use-as-is foam). The LO 2 Tank Acreage is machine sprayed foam. 

Because the dissections have uncovered no defects in machine sprayed foam, this area is not 
considered to be at risk for divoting. 

LO 2 Ice/Frost Ramps (use-as-is foam). The ice/frost ramps are poured in place over the 
pressurization line brackets. Most of the ice/frost ramp is poured over machine sprayed foam. 
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Only a small area (approximately a 1-inch margin around the base of the pressurization line 
bracket) of the poured foam contacts the substrate. The ice/frost ramp is at risk of sealed void 
divoting. Air enrichment-induced divoting is also possible. 

LO 2 PAL Ramp (use-as-is foam). The PAL ramp is applied as a hand spray over machine 
sprayed foam. First, the rind of the machine sprayed foam is removed, then Cono thane is 
applied over the machined foam, and finally the PAL ramp is manually sprayed on. This 
location is at risk of sealed void divoting. Air enrichment induced divoting is also possible. 

LCL/Intertank Flange (use-as-is foam). The flange closeout is a hand spray. This location is at 
risk of sealed void divoting. It is also at risk of air-enriched void divoting. 

Intertank Acreage (use-as-is foam). The intertank acreage is machine sprayed, machined to 
minimum thickness, and then punctured. The thin foam and perforation limit the size of divoting 
to a size within acceptable limits. 

IT Ice/Frost Ramp (use-as-is foam). The ice/frost ramps are poured in place over the 
pressurization line brackets and machine sprayed foam. Only a small area (approximately a 1” 
margin around the base of the pressurization line bracket) of the poured foam contacts the 
substrate. This location is at risk of sealed void divoting. Because the intertank is relatively 
warm in the area of the ice/frost ramps, little air enrichment can occur. 

LFL/Intertank Flange (new foam). The LFL/Intertank Flange closeout is hand sprayed over the 
bare substrate. Sealed void divoting is possible. Voids at the substrate are susceptible to 
cryoingestion from the intertank purge gas and to cryopumping from the ambient air. Venting 
voids not in contact with the substrate are susceptible to air enrichment. 

Bipod (new foam). Sealed void divoting can occur. Voids in this closeout are susceptible to 
cryoingestion from the intertank purge gas and to cryopumping from the ambient air. 

Forward LH 2 PAL Ramp (new foam). The PAL ramp is applied as a hand spray over machine 
sprayed foam and the hand sprayed flange closeout. Sealed void divoting can occur. Venting 
voids are also susceptible to air enrichment. 

Aft LH 2 PAL Ramp (use-as-is foam). The PAL ramp is applied as a hand spray over machine 
sprayed foam. Sealed void divoting can occur. Venting voids are also susceptible to air 
enrichment. 

LH 2 Ice/Frost Ramps (use-as-is foam). The ice/frost ramps are poured in place over the 
pressurization line brackets and machine sprayed foam. Only a small area (approximately a 1” 
margin around the base of the pressurization line bracket) of the poured foam contacts the 
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substrate. This location is at risk of sealed void divoting. The ice/frost ramps forward of station 
1290 experience substrate heating before 130 seconds MET and are at risk of cryopumping 
induced divoting from voids at the substrate. Venting voids in the body of the foam of all the 
ice/frost ramps are at risk of air enrichment induced divoting. 

LH2 Tank Acreage (use-as-is foam). The LfE Tank Acreage is machine sprayed foam. 

Because the dissections have uncovered no defects in machine sprayed foam, this area is not 
considered to be at risk for divoting. 

Cryoingestion must be assessed because it is a possible defect mechanism. The defects found in 
the lead and trail spray panels and in the V&V sprays for the improved closeout at the 
LfB/Intertank flange must be assessed for the three factors that are required to cause divoting: 

1 . The presence of a flow path to the intertank purge gas. 

2. The defect size in relation to the divot/no divot curves. 

3. The probability that the flow path is in the critical range to support void filling during 
tanking and pressurization from ullage gas heating during ascent. 

Cryopumping is not a probable divoting mechanism. The lack of voids in the machine sprayed 
foam eliminates cryopumping as a concern in the acreage foam. No voids were found in the 
LTB/intertank flange closeout lead and trail spray panels, or V&V sprays in locations that would 
be cold enough to allow cryopumping. Also, no voids were found in the LfE ice/frost ramp 
dissections in locations susceptible to cryopumping. 

Air enrichment is also not a probable divoting mechanism. Analysis of the air enrichment that 
occurs during the 6.5 hour pre-launch hold and the pressure difference between the void and the 
atmosphere during ascent show that a narrow range of small (on the order of 0.001 inch or less) 
cracks will result in significantly more pressurization than is the case for sealed voids. Larger 
cracks allow the voids to vent during ascent. Smaller cracks effectively seal the voids against air 
enrichment. Owing to the narrow critical range of extremely small cracks, this failure 
mechanism is considered to be improbable. 

The most probable divoting mechanism for the ET foam is sealed void divoting. The probability 
for individual locations must be assessed based on the void distribution in the non-machine 
sprayed foams and the void depths. The possible and most likely foam loss mechanisms for each 
location are summarized in Table 3.4-1. 
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Table 3.4-1. Divoting Mechanism Summary 




Cryoingestion 

Cryopumping 

Sealed 

Void 

Air 

Enrichment 

LO2 Tank Acreage 

use-as-is 

- 

- 

- 

- 

LO2 Ice/Frost Ramps 

use-as-is 

- 

- 

most 

probable 

improbable 

LO2 PAL Ramp 

use-as-is 

- 

- 

most 

probable 

improbable 

LCL/Intertank Flange 

use-as-is 

- 

- 

most 

probable 

improbable 

Intertank Acreage 

use-as-is 

- 

- 

- 

- 

IT Ice/Frost Ramps 

use-as-is 

- 

- 

most 

probable 

- 

LH 2 /Intertank Flange 

new closeout 

likely low 
probability but 
must be 
assessed 

low probability 

most 

probable 

improbable 

Bipod 

new closeout 

likely low 
probability but 
must be 
assessed 

low probability 

most 

probable 

improbable 

Forward LH 2 PAL Ramp 

new closeout 

- 

- 

most 

probable 

improbable 

Aft LH 2 Pal Ramp 

use-as-is 

- 

- 

most 

probable 

improbable 

LH 2 Ice/Frost Ramps 

use-as-is 

- 

low probability 

most 

probable 

improbable 

LH 2 Acreage 

use-as-is 

- 

- 

- 

- 


3.5 Implications and Conclusions 

The SSP implemented a three-tier process for evaluating foam debris impact C/E. The process 
evolved from a certification rigor “WOW” analysis to a “best estimate” analysis, and then to a 
Monte Carlo-based probabilistic analysis to quantify risks. 

The “best estimate” analysis should include a system level FOS impact C/E of at least 1.4. Any 
foam debris case not meeting a “best estimate” C/E of 1 .4 should be further analyzed with a 
Monte Carlo-based probabilistic method to quantify the remaining risks. 
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3.6 Recommendations 

1 . Perform an end-to-end Monte Carlo-based probabilistic analysis for the foam debris cases 
that do not have a “best estimate” impact C/E of at least 1.4. 

2. Cryoingestion should be included in the Monte Carlo-based probabilistic analysis of the 
foam debris cases that do not satisfy the system level “best estimate” impact C/E of at 
least 1.4. 
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4.0 Ice Debris from the External Tank 

4.1 Assessment of Engineering Data 
Controls to Mitigate Ice 

To some extent, ice debris is controlled by the Launch Commit Criteria (LCC). The LCC has 
been established such that the launch cannot take place if the ice criteria are exceeded without 
approval of a formal LCC waiver. The updated criteria for return to flight (RTF) include an 
expanded No Ice Zone to protect the Orbiter windows. The LO 2 feedline bellows acceptance 
criteria is intended to limit ice formation to a level that does not result in unacceptable damage to 
vulnerable TPS and structure. A visual inspection requirement has been established based on a 
0.3-inch ice in an 8-inch arc. However, this requirement was established by the 0.053 lbm 
requirement that has recently been shown to be unacceptable. The NESC expects the LCC to be 
revised to reflect the positive benefit from implementing ice mitigation design changes to the 
LO 2 feedline bellows joint. There are other locations of ice formation that are less threatening to 
the Orbiter. 

Examination of Bellows Ice and Tile Damage Flight History Data 

The flight history was examined for cases of bellows ice debris. Thirty three (33) flights were 
examined where bellows ice could be observed in separate photographs and video imaging. Of 
these documented cases, eighteen (18) percent of the bellows did not lose any ice. One bellow 
lost all its ice. The average ice lost was about 16 percent per bellow. The flight history data 
was also examined to identify possible damage from ice impacts to the Redesigned Solid Rocket 
Motor (RSRM), SRB, or Orbiter. The general conclusion was that ice debris and damaging 
impacts are common. There does appear to be an Orbiter right side bias to the potential impacts 
thought to be caused by ice. Damaging ice impacts appear to be more likely to occur when pre- 
launch environment has low-to-medium relative humidity. Finally, damaging ice impacts occur 
on both “typical” and “light ice” conditions. 

There is an extensive database on impact damage to tile. Approximately 16,000 cases of damage 
to tile have been recorded. Of these cases, only about 2,000 are well documented, with only 300 
cases documented with photographs. These latter cases comprise a dataset that is referred to as 
the “platinum dataset”. This database was recently re-examined in an attempt to identify the 
damage cases most likely due to ice impacts. The features of tile damage recorded in the 
platinum dataset were compared to the features of ice damage documented from impact testing. 
(Test results show that foam damage tends to be broad and shallow whereas ice damage tends to 
be narrow and deep). Four cases of significant damage referred to as “close calls” were found. 
One of these cases was attributed to ablator debris from the SRB nose cap. This is viewed as a 
well understood anomaly and corrective actions were taken to prevent reoccurrence. A second 
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case was attributed to cork debris from the SRB. The remaining two cases are likely from ice 
debris. These four damage states are referred to as close calls because they were so severe that if 
the impacts had occurred in slightly different locations, the vehicle may not have survived re- 
entry. 

Ice Impact Test Data 

The data from full-scale ice-on-RCC impact tests is very limited. The test results show that ice 
impacts cause more RCC coating loss and delamination than does foam. Orbiter ice impact 
threshold capabilities for WLE panels are considerably less than maximum-possible and best- 
estimated ice environments. The cases analyzed are feedline bellows ice drip lip and feedline 
bracket yoke base fitting ice. The “best estimate’ C/E for Panel 12 is 1.11 and 0.45 for the 
feedline bracket ice and feedline bellows ice cases, respectively. The end-to-end analysis does 
not support an assured control level. 

Ice Formation and Liberation Tests 

Testing is underway to determine the characteristics of ice that forms on the LO 2 feedline 
bellows (mid and aft locations without a heater to prevent ice formation) and feedline brackets 
that may be liberated during launch and ascent. The bellows tests were conducted to compare ice 
formation and liberation on the original bellows design to the redesigned drip lip configuration. 
The original test program was not planned with the objective of developing a comprehensive, 
quantitative database on ice liberation for the probabilistic analysis of ice debris impacts on the 
Orbiter. Likewise, the bracket ice formation and liberation test programs (in-progress) are 
limited to six planned tests. While somewhat limited in scope, the data generated from these test 
programs will be an essential benchmark on the debris distributions used in the probabilistic 
analysis. (See Section 10.) 

Nose Cap and Windows 

There is no ice debris transport mechanism (TM) identified to the Orbiter nose cap and chin 
panel. Windows are protected by the No Ice Zone or not threatened by other ice with no 
transport mechanism (TM). 

4.2 Limitations and Gaps 

1 . Limited ice-on-RCC impact testing has been conducted. Ice is not fully characterized to 
support testing and model development. The density of ice is still being studied and the 
development of impactor test specimens is still under development. This data is also 
needed to support the development of the impactor model used in the LS-DYNA® code to 
simulate ice-on-RCC or ice-on-tile impact events. 
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2. The redesigned feedline bellow drip lip has not been demonstrated to liberate less ice 

than the original design. (The decision to use heaters at the forward bellows location to 
prevent ice formation is being implemented). 

4.3 Implications and Conclusions 

The engineering work is incomplete to support flight rationale for expected ice debris from the 
mid and aft feedline bellows and the feedline brackets. A probabilistic analysis will be 
conducted to estimate the level of risk due to expected ice debris from the feedline mid and aft 
bellows and the feedline brackets. (See Section 10.) 
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5.0 Debris with No Transport Mechanism 

5.1 Assessment of Engineering Data 

The SSP has identified a large number of debris sources that are cleared with a flight rationale 
based on having no TM to the Orbiter TPS (RCC or tile), windows or other vulnerable structure. 
Of the 173 sources in the expected debris table, 20 sources are identified with no TM to the tile, 
65 with no TM to the RCC, and 71 with no TM to the Orbiter windows. The rationale for 
clearing these debris sources was a combination of analysis and assessment. “Analysis” 
indicates that an actual DTA was completed to determine whether the debris source could hit the 
TPS or windows. “Assessment” indicates that an engineering estimation of no TM was made 
based on general knowledge of vehicle flow fields without specific DTA. Special attention was 
paid to ensuring that this debris would not be at risk of being entrained in the re-circulation flow 
fields in the aft part of the vehicle at the base of the ET behind the ET attach structure. For the 
DTA cases, a WOW debris transport was used in determining if there was a mechanism for TM. 

The debris cleared by “assessment” are generally from sources which are very far aft on the 
stack, such as RSRM slag, SRB hold down post debris, etc., relative to the vulnerable structure 
(TPS or RCC). As an example for windows, debris sources aft of XT 1104 are aft of the Orbiter 
windows, and, therefore are reasonably assessed as having no TM to the windows. Masses range 
from SRB separation motor ejecta on the order of 10' 5 lbm up to SRB aft skirt web firoth- 
pak/instafoam debris up to 0.5 lbm. The legitimacy of the debris masses was not evaluated, as 
the critical element of this rationale is the transport of debris, not the mass. Small masses 
(<0.0002 lbm) are propulsive in nature and, therefore, do not fall into the general <0.0002 lbm 
mass accepted risk category. This hazard is classified as improbable/catastrophic (green). 

5.2 Limitations and Gaps 

The limitation of this argument lies in the modeling and understanding of the Orbiter flow fields. 
Several of these debris sources were eliminated on the basis of engineering judgment without 
any specific computational effort. Additionally, no data or summary of results were provided for 
review of these conclusions. 

5.3 Implications and Conclusions 

Given the location of the debris sources in question, and the relatively well understood nature of 
the flow fields in these areas, “no TM” appears to be a sound rationale for the items identified. 
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6.0 Debris Transport Analysis (DTA) 

6.1 Assessment of Engineering Data 

The DTA relies on five primary data sources and inputs. These are combined through the DTA, 
which outputs the mass, velocity, location and angle of predicted debris impacts. These 
parameters are then combined to yield the impact KE used to establish E in the C/E calculation. 

1 . The DTA utilizes a combination of the ET foam test data and assumptions to establish the 
debris shape, mass, density and volume. The DTA also utilizes the results of the 
extensive foam dissection database of voids assembled from previously sprayed tanks, 
primarily ET-94, and the resulting divot/no-divot curves established via the ET thermal 
vacuum divot generation testing. The divot shape is assumed to be a 60-degree half angle 
truncated cone or frustum, which approximates the ET thermal vacuum foam divots and 
yields a conservative mass for a given divot size. The density is based on the ET 
Project’s provided mean measurement/calculation per foam application or part. The 
resulting debris particle mass and volume are then calculated from the above data and 
assumptions by tying the divot thickness and inner diameter to the ET divot/no-divot 
data. As applied in the WOW analysis, the ET certification allowable mass (documented 
as the Vol. X requirement) is assumed at the mean foam density. The volume is then 
related to the ET data using the “ultimate” (FOS of 1.4 included) divot/no-divot line. For 
the “best estimate” analysis, the ET Project defined that the maximum void size is set to 
the frustrum inner diameter. The volume is then calculated using the “limit” (FOS of 1.0) 
divot/no-divot line. The resulting “maximum expected mass” is generated using a mean 
density with a +3-sigma variation in the Monte Carlo analysis. 

2. The initial foam release conditions, debris release location, time, pop-off velocity and 
angle, are inputs for the DTA. Combined with the debris mass and flight condition 
variations, these initial conditions produce millions of debris source locations and 
trajectories in the Monte Carlo analysis. Debris release location is assumed to be 
“uniformly” distributed across the ET for each foam application, or part and results in 
what is essentially a survey of all potential debris release locations. Both WOW and the 
“best estimate” DTA use the same distribution of release location cases. The debris 
release time is focused on that portion of the ascent trajectory, Mach 2.2 to 3.0, shown to 
maximize the resulting KE (combination of maximum dynamic pressure conditions 
(maximum debris acceleration) and largest relative velocity, yielding the peak potential 
AV - debris to launch vehicle). Both WOW and “best estimate” DTA assume debris 
release times at four discrete Mach numbers — 2.2, 2.5, 2.75 and 3.0. The debris pop-off 
velocity and angle complete the initial release condition definition. Both the WOW and 
“best estimate” DTA use a pop-off velocity defined from an empirical fit of thermal 
vacuum test data derived from video analysis (0 to 300 fps) +30 fps. The curve-fit 
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provides pop-off velocity as a function of debris mass. In general, the release angle is 
assumed to be perpendicular to the surface ±10 degrees. However, some foam 
applications (e.g. ice/frost ramps) are varied by larger amounts accounting for geometric 
considerations. 

3. The debris aerodynamic model is simplified to provide drag for ballistic trajectory DTA 
and approximate lift to establish the debris cross-range. The breakup of the foam debris 
has also been investigated. The debris drag model for the frustum shape is based on 
extensive Computational Fluid Dynamics (CFD) analysis validated with wind tunnel, 
ballistic tunnel, and F-15 flight test data. The analysis provides drag as a function of 
debris particle orientation, which results in a nominal drag value for an oscillatory 
orientation and maximum drag value for the frustum aligned axially into the flow 
direction and a minimum drag value for edge on flight condition. The debris lift effects 
are estimated by CFD analysis and validated with limited wind tunnel test data 
correlation. The analysis bounds the limited test data. Debris particle lift is treated as a 
dispersed cone around a zero-lift trajectory. The WOW DTA uses the test-validated CFD 
nominal drag level. The “best estimate” varies drag from nominal to broadside value 
over a uniform distribution in the Monte Carlo analysis. The CFD analysis derived lift 
levels are varied from a mean value by +2-sigma. As an additional consideration, F-15 
flight testing and wind tunnel testing indicates that foam debris breakup is very unlikely 
at expected release conditions and is, therefore, not modeled in the DTA. 

4. The DTA relies on the CFD analysis to produce the flow field to transport the debris. 

The STS launch vehicle flow field is provided as a function of Mach number from 0.6 to 
5.0, angle-of-attack, and angle-of-sideslip to cover the range of conditions in the debris 
transport sensitive portion of the ascent trajectory. Based on recommendations of 
previous NESC peer-reviews, extensive wind tunnel test (on-surface and off body) data 
has been used to validate CFD results and the simulated flow fields. Geometric models 
(both test and analysis) were updated to more accurately represent STS launch vehicle 
configuration at a very high fidelity for debris transport. The geometric modeling is 
impressive in detail. The maximum error in global flow field velocity is estimated at less 
than two percent and is not considered a significant source of error or limitation of the 
DTA. 

5. The actual flight conditions (Mach, angle-of-attack & sideslip, dynamic pressure, and 
velocity) for debris release are provided by the results of Guidance Navigation and 
Control (GN&C) simulation of STS launch vehicle trajectories. For WOW DTA, the 
GN&C simulation sampled 150 wind profiles for a June launch that have been scaled to 
produce a high dynamic pressure trajectory (and therefore yield maximum debris 
acceleration conditions). The “best estimate” DTA is tied to nominal STS- 1 14 trajectory 
conditions. 
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6.2 Limitations and Gaps 

1. Foam Shape, Density, Mass & Volume. The assumed frustum debris shape results in a 
conservative mass estimate (includes volume not seen in typical divots). The DTA ties 
the foam debris calculations to the ET Project’s provided divot/no-divot curves yielding 
foam debris at a fixed volume with a maximum thickness assumed. Holding this volume 
constant and varying the mass yields an intermediate range of ballistic numbers resulting 
in a spread of KE levels per debris source location. However, density effects on divot/no- 
divot curves are not included. Overall, this is a conservative approach to debris size and 
mass resulting in increased predicted levels of KE. 

2. Release Conditions. The release conditions applied affect both the resulting impact KE 
and range of impacts. Foam debris release is assumed at the worst-case flight conditions 
(i.e., producing maximum KE) and is not necessarily directly tied to a thermal and 
structural foam failure analysis. This produces a conservative KE result. Currently, data 
provided by the ET Project to adjust the foam release conditions are incomplete. (Note: 
Data will be provided for the identified foam cases to be assessed by probabilistic 
analysis. See Section 10.) Pop-off velocity is based on video analysis at relatively low 
frame rate. The resulting uncertainty in the calculation is incorporated with the bounding 
curve. 

3. Debris Aerodynamics. Modeled divot shapes are idealized representations (spheres, 
cubes and for foam frustums) of actual debris. The assumed debris shape is fundamental 
to the resulting aerodynamics. This necessary assumption is a limitation to the DTA 
overall accuracy. Debris lift is based on a bounding CFD analysis not validated due to 
limited test data. An assumed 2-sigma variation in lift is applied. 

4. Ice Aerodynamics. Currently based on CFD analysis of assumed shape without test data 
validation (limited testing is planned prior to RTF). Breakup of ice is not quantified at 
this time and requires validation testing (planned prior to RTF). 

6.3 Implications and Conclusions 

1. Foam Shape, Density, Mass & Volume. The worst case combination of low density 

and resulting increased volume for a fixed mass is not covered in the DTA. This is offset 
by the assumed shape resulting in larger volume divots than typically generated in 
ground-based testing. 
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2. Release Conditions. Both the timing and distribution of foam release result in the most 
conservative estimate of potential debris impacts. The pop-off velocity data contributes to 
the large areas of potential debris impacts. 

3. Debris Aerodynamics. The assumed frustum shape is representative of typical foam 
divots adding conservatism and realism to the DTA. The lift cone dispersion results in 
large areas of potential debris impacts. 

4. Ice Aerodynamics. Given the current concerns regarding ET LO 2 feedline bellows ice, 
test validation of the CFD-generated aerodynamics is required. 
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7.0 Re-Entry Burn-Through of the WLE RCC 

7.1 Assessment of Engineering Data 

An empirical tool to predict RCC damage growth after an impact event was developed from 
arcjet test data. The RCC Damage Growth Tool is used to determine: acceptable damage criteria 
for the Orbiter RCC; the rationale for RCC damage repair; and to establish the on-orbit RCC 
inspection criteria. The following paragraphs describe the assessment of the suitability of the 
arcjet test data and the resulting empirical tool to support the flight rationale. 

Any empirically predictive analysis tool is limited by the extent that the environments used for 
tool development correspond to those encountered during flight. The RCC Damage Growth 
Tool was developed and validated using only stagnation arcjet test data. It is well documented 
that there are substantial differences between the arcjet and flight environments. The RCC 
Damage Growth Tool is based on the assumption that the performance of RCC can be 
characterized as a function of temperature and pressure only from stagnation flow arcjet test 
data. This critical assumption, that the arcjet testing based stagnation flow produces 
conservative results compared to flight, has not been substantiated by a V&V program. 

Given the impracticability of obtaining realistic flight data, the validation claim depends on the 
degree to which arcjet conditions match flight conditions. Since none of the RCC WLE surface 
experiences stagnation heating, the conservatism claim requires critical evaluation. A mismatch 
of test and flight conditions may exist if RCC damage growth is sensitive to crossflow 
environmental factors that stagnation testing cannot reproduce. One means of evaluating the 
sensitivity of the tool to deviations from stagnation is to expose specimens to crossflow 
conditions (i.e., flow with substantial shear) and compare the test results to both stagnation 
results and predictions. Wedge tests were designed to produce crossflow data by reducing the 
specimen angle-of-attack relative to the flow axis. If stagnation quantities are sufficient to 
characterize damage growth, then the wedge testing, at the same stagnation temperatures and 
pressures, should produce results (time to breach and hole growth rate or size) similar to those 
from stagnation testing. 

7.2 Limitations and Gaps 

The current RCC Damage Growth Tool is validated only for stagnation flow cases. Its level of 
conservatism and application to non-stagnation cases has not been validated. 

7.3 Implications and Conclusions 

The engineering interpretation of the experimental data is adequate to establish the RCC impact 
damage requirement — coating loss with delamination — in support of the flight rationale 
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development. However, the reliance on only the stagnation test experimental data as the 
empirical basis of the Math Model Tool for time to breach predictions may not be conservative. 
This reliance brings into question the accuracy of the time to breach predictions on the WLE 
where it has not been demonstrated that stagnation flow is a reasonable approximation for 
damaged RCC environment. This is of critical importance for WLE locations where the tool 
currently predicts pass versus fail. In addition, the V&V program has not adequately addressed 
this modeling deficiency. Finally, the uncertainty in the results from the tool has not been 
quantified to establish a basis for the pass/fail criterion. Because of these findings, the NESC 
views the tool maturity level as developmental in nature as opposed to a certified/validated 
engineering tool. Therefore, the results of the tool must be interpreted by an experienced subject 
matter expert (i.e., the tool developers) to support management decisions regarding on-orbit RCC 
damage assessments. Addressing the wedge flow test results in the time to breach predictions 
and establishing an end-to-end uncertainty level are considered essential requirements to reliably 
apply the tool for on-orbit assessments. 

7.4 Recommendations 

1 . Additional arcjet tests, including wedge flow tests, with specimens containing actual 

impact damage rather than simulated impact damage, are required to establish the level of 
conservatism in using the RCC Damage Growth Tool for all vehicle locations and impact 
damage cases. 
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8.0 Impact Capability of the Orbiter RCC 

8.1 Assessment of Engineering Data 

1 . The significant effort expended on impact testing and analysis has greatly expanded the 
understanding of the impact capability of RCC. 

2. RCC material data are based on the 1994 Loral Report plus material testing perfonned 
post -Columbia. New data is consistent with previously developed RCC design data. 

3. Finite element model (FEM) simulations using LS-DYNA code provide analysis results 
based on empirically-derived material data input definitions that qualitatively correlate 
with observed test behavior. 

4. LS-DYNA correlations are performed with flat panels and WLE panel (9L) tests. 
Maximum deflections correlate to within 10 percent and damage maps, using the “l-to-5 
elements out” criterion, qualitatively correlate with test data. (The deflection time 
histories for the 6” x 6” flat panels seem to correlate up until damage initiates and 
deviates after that point. The charts in Section 4.2. la of the data pack indicate resultant 
displacement errors of 20 percent). 

5. Test results clearly identify the RCC impact threat due to foam and ice debris, which had 
not been previously characterized. Testing was perfonned at several locations on specific 
panels (flat and full panels). The LS-DYNA analysis was validated using these test 
results. LS-DYNA C was then used to analyze other panels and panel locations to 
evaluate capability against foam and ice debris impact. 

6. Parametric studies have been performed on the impact behavior of the WLE RCC panel 
apex region using rectangular foam and ice impactors. The rectangular foam brick with 
its length aligned with velocity trajectory presents the worst case. The square block of 
ice with the large face impacting tangent to the panel produces the largest damage. 

8.2 Limitations and Gaps 

(Cl 

1 . LS-DYNA can only be used to predict the “onset of NDE detectable damage” or 

threshold of damage. LS-DYNA cannot be used to predict damage growth because the 
material damage model in LS-DYNA' does not accurately model all forms of RCC 
damage. Furthermore, the LS-DYNA' damage parameter value that predicts the 
threshold of damage in WLE RCC panels is very close to he damage parameter value that 
predicts a through-the-thickness crack. Therefore, the LS-DYNA® predictions lack the 
fidelity necessary to show that the RCC is damage tolerant. 
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0 2 

2. The small mass effect is assumed to vary by a factor (mi/rm) ' where mi is the mass of 
the debris and m 2 is the mass of the WOW estimate. This factor appears to be derived 
analytically and empirically-correlated with the LS-DYNA® prediction based on m 2 , 0.03- 
lbm in most cases. This factor needs to be validated using test data. Bounds on 
correctness of this factor have not been established, especially as size limits are 
approached. Also, this factor does not appear to be valid for the nose cap. 

3. The material orientation changes continuously on the surface of the doubly curve shell 
nose cap. As such, orientation of elements appropriate to the material orientation is very 
difficult to achieve. Only one FEM for the nose cap exists and as such the fidelity of the 
finite element solution is not well established. 

4. Because of the different RCC material (laminate) configuration in the nose cap, the 
NESC has no assurance that the failure modes exhibited by the WLE panels are the same 
as those for the nose cap. The pads (ply drops) used to achieve the required thickness of 
the nose cap are highly susceptible to initiating delaminations for out-of-plane loads, such 
as those produced by debris impact. 

8.3 Assessment of “Best Estimate” Logic for RCC 

Note: Presented at the DVR, April 7-9, 2005. 

1 . The reported “knock-down factor” on C for “no NDE detectable damage” is in fact a 
requirement. The damage requirement changed from the through-the -thickness crack 
(“l-to-5 elements out”) to “onset of NDE detectable damage” as a result of the RCC 
bum- through tests and analyses. 

2. Furthermore, the C computation should be adjusted by 0.56 rather than 0.69 to meet the 
damage onset requirement. The basis for this value is to account for the uncertainty and 
variability in the RCC material property data and the LS-DYNA material model used to 
simulate the RCC response. Recent analyses indicate the velocity factor should be 0.75 
(0.5625 on KE) and not 0.83 (0.69 on KE). 

3. The “best estimate” of capability must include an adjustment to account for the higher 
density and stiffness for PDL foam (a factor of 0.8 is used on KE). 

4. Using observation #2 above, an example calculation for the bipod closeout foam debris 
case (Panel 12) is as follows: 

• Predicted using 10 percent aging only; Lowest C/E Panel 12 - 1494 ft-lbs (ft-lbs) 

• Onset of NDE detectable damage (0.5625) - 1494*0.5625 = 840 ft-lbs 

• Material properties (“best estimate” and MPM) (1.22) - 840/1.22 = 689 ft-lbs 
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• Mass adjustment for small masses: (0.01 07/0.03)° 2 *689 = 560 ft-lbs. 

This revised value is 23 percent lower than the reported value of 686 ft-lbs presented at 
the DVR on April 8, 2005. Table 8.3-1 presents the comparison of the NESC values 
computed to the SSP’s DVR values (as described above). 


Table 8.3-1. Comparison of “Best Estimate” C-Values and C/E-Ratios 


Tank Location 

C-Values, ft-lbs 

E- 

value, 

ft-lbs 

C/E Ratios 


NESC Values 

SSP DVR 
values 

NESC 

Values 

SSP 

DVR 

values 

L0 2 Acreage (Ogive) 

388 

475 

180 

2.2 

2.6 

L0 2 Flange 

533 

652 

587 

0.9 

1.1 

Intertank Acreage 

405 

496 

164 

2.5 

3.0 

LH 2 Flange 

489 

599 

339 

1.4 

1.8 

LH2 Acreage 

401 

491 

134 

3.0 

3.7 

L0 2 Ice/Frost Ramps (PDL) 1 

337 

636 

622 

0.5 

1.0 2 

Intertank Ice/Frost Ramps (PDL) 1 

337 

636 

437 

0.8 

1.5 2 

LH 2 Ice/Frost Ramps (PDL) 1 

334 

632 

395 

0.9 

1.6 2 

L0 2 PAL Ramp 

481 

590 

353 

1.4 

1.7 

LH 2 Forward PAL Ramp 

481 

590 

306 

1.6 

2.0 

LH 2 Aft PAL Ramp 

482 

590 

296 

1.6 

1.9 

Bipod Closeout 

560 

686 

607 

0.9 

1.1 

PDL high density foam adjustment 20 percent (a factor of 0.8 is used on KE) 
2 NESC cannot reproduce these computed numbers 
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8.4 Implications and Conclusions 

1 . The RCC laminate, used in both the WLE and nose cap TPS, is not a damage tolerant 
material system. RCC is characteristically a brittle system with significant variability in 
material properties. RCC properties are dependent on temperature, conditioning, and 
coating parameters used in both the fabrication and operational use. These variabilities 
need to be accounted for in the RCC damage threshold predictions. Limitations on the 
LS-DYNA l prediction of the onset of NDE detectable damage for RCC structures also 
need to be included as engineering uncertainties. 

2. The SSS C/E should be at least 1.4, which is consistent with the FOS-specified value in 
NASA STD-5001 which is 2.0 for composite structure with discontinuities and 1.4 for 
uniform composite material. As the impact capability is computed for uniform regions of 
the RCC, which are not dominated by discontinuity stresses, the value of 1 .4 seems more 
appropriate. 

8.5 Recommendations 

1 . Perform a sensitivity study to mesh refinements. Also, the sensitivity to mesh 
refinements and material orientations in the elements near probable impact locations 
would provide insight on important variables in the behavior of the nose cap. 

2. Impact tests of the nose cap and test/analysis correlation of results are needed to validate 
the analysis predictions. 

3. The “best estimate” value of C should be computed using material properties that 
accounts for material variability inherent in RCC and the end-of-life aged RCC 
properties. 
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9.0 Impact Capability of Orbiter Tile 

Tile debris flight rationale falls into the following five categories. 

1 . No Transport Mechanism (Section 9.1) 

2. Damage Tolerance (Section 9.2) 

3. Analysis of Historical Flight Damage (Section 9.3) 

4. Probabilistic Flight Rationale (Section 9.4) 

5. Accepted Risk Based on Previous Flight History (Section 9.5) 

6. Other (Tile Over Critical Seals and Penetrations) (Section 9.6) 

The strengths, weaknesses and knowledge gaps for each of these rationales are discussed in the 
sections below. 

9.1 No Transport Mechanism 

The discussion of no transport mechanism as flight rationale in general is detailed in Section 5.0. 

9.2 Damage Tolerance 

9.2.1 Assessment of the Engineering Data 

This methodology describes the allowable tile damage depth for the Orbiter’ s lower surface on a 
“damage map”. This map is constructed by dividing the Orbiter lower surface into 3 1 zones, and 
determining the maximum allowable penetration depth using a combination of several analytical 
models (see Figure 9.2-1) including: 

• Rapid Response Damage Model 

• Aeroheating Tools 

• 3-D Thermal Math Model (TMM) 

• Tile Stress and Bondline Integrity Tool 

• Structural Stress Assessment Model 
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Figure 9.2-1. Flow of Data Defining Environment, Modeling Damage, Analyzing 
Capability and Culminating in the “Damage Tolerance Threshold Map” 

There are Rapid Response Damage Models for both foam and ice impacts on tile that generate a 
damage geometry (depth, length, width, entry, wall and exit angles) based on DTA parameters 
(mass, velocity and angle of impact). The foam on tile model was developed by Boeing and is 
an empirical curve-fit based on over 500 impacts of foam projectiles on tile. The resulting curve 
is fit to envelope 95 percent of all test data. Tests cover a range of projectile masses (0.002 lbm 
to 0.04 lbm), projectile angles (5 degrees to 60 degrees), velocities (200-2900 fps), and impactor 
materials (BX-265, PDL, and NCFI). BX-250 was not utilized as a part of the test matrix, but 
has been assumed to be enveloped by BX-265. This assumption is based on the similarity of the 
two material stress-strain properties. Testing does include both High-temperature Reusable Surface 
Insulation (HRSI) (black) and Low-temperature Reusable Surface Insulation (LRSI) (white) tile, 
pristine and aged tile, and tile arrays both with and without gap fillers. Current proposed limits 
on tool usage do allow extrapolation beyond specifically tested combinations of parameters. 

The ice/ablator Rapid Response Damage Model was developed by Southwest Research Institute 
(SwRI) and is based on equations derived from first principles of physics. The equations of 


NESC Request No. 05-010-E 





@ 

NASA Engineering and Safety Center 
(NESC) Technical Assessment Report 

Document #: 

RP-05-82 

Version: 

1.0 

Title: 

NESC Peer-Review of the Flight Rationale for Expected 

Debris Report 

Page #: 

43 of 148 


motion are integrated forward in time until the impactor speed drops below the crush velocity 
(i.e., it comes to rest), or the impactor is forced back to the tile surface. The tile resisting stress is 
modeled as a function of the Hugoniot stress and the tile crush strength. The Hugoniot stress is 
the stress as a function of particle velocity along the idealized one-dimensional planar impact. 
Approximately 350 impacts of ice and ablator on tile have been used for validation to ensure that 
the proper fundamental physics are being represented in the models. Tests cover a significant 
range of projectile masses (up to 0.25 lbm), projectile angles (5 degrees to 90 degrees), velocities 
(200 fps-1000 fps) and impactor density (ablator, dense ice, low density ice). The material 
properties are scaled, or “softened”, to ensure that 95 percent of the test data is enveloped. The 
scaling of the material properties is consistent with the type of scatter seen in the material 
properties test program. In addition, because of the nature of this type of modeling, additional 
test data was generated on large strain stress-strain behavior for tile material. Current proposed 
limits on tool usage do allow significant extrapolations in impact velocity (up to 1500 fps) for 
dense ice and ablator. Additional efforts are underway to provide the basis for other 
extrapolations for ablator and low density ice on angle of impact. SwRI uses CTH hydrocode 
models with their Rapid Response Impact Model to support extrapolations as required. 

In the case of both the foam and ice impact, the resulting damage is represented as a simplified, 
or shoebox, geometry (see Figure 9.2-2). Simplified, cavities average the irregular shapes of real 
cavities for ease of analysis and representation. This simplified geometry is necessary to 
maintain consistency with the wind tunnel test configurations used to derive the cavity heating 
augmentation factors. 


Coating Loss 2 
1.79 1.74 



1 . 82 


Figure 9.2-2. Simplified Impact Geometry 
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The change in the nominal Orbiter surface aerodynamic heating profile produced by damaged 
tile TPS is then defined through the application of a series of Aerothermal Tools (see Figure 9.2- 
3). This suite of Aerothennal Tools is used to detennine the aeroheating augmentation factors 
and the appropriate Aerothermal environment needed to support the thermal analysis of damaged 
tile regions. Heating profiles in the damage region are modeled by assigning a baseline 
(“undisturbed”) heating value near the damage and applying augmentation factors to the nominal 
heating value for the effected regions in and around the TPS damage site. The process defines 
the damage site heating levels as a function of time along the entry trajectory. As a final 
Aerothermal step, a catalytic heating augmentation factor to account for changes in damaged 
surface properties is also defined. 

The Aerothermal analysis is initiated with the damage location and geometry information which 
is input to the Boundary Layer Transition (BLT) Prediction Tool. From this information, the 
BLT Prediction Tool is used by aeroheating analysts to provide the Cavity Heating Tool (CHT) 
with the appropriate transition Mach number, which is needed to detennine the boundary layer 
state. Then, the appropriate cavity heating methodology can be used. To establish the expected 
time of BLT during entry, the BLT Prediction Tool uses the observed damage and/or repair 
locations and geometries to determine the most appropriate roughness value for each damage 
site. The selected transition Mach number (corresponding to the roughness value selected) is 
then provided to the CHT for augmentation factor methodology. In addition, the transition time 
must be provided to the 3-D TMM for selection of the appropriate Aerothermal baseline 
environment, on which to apply the augmentation factors. 

Once the transition Mach number input is established, the CHT will draw on information 
provided by the Smooth Outer Mold Line (OML) Aerothermal CFD Solution Database 
(SOASD). The SOASD will be used to generate the boundary layer parameters (i.e., boundary 
layer thickness) needed by the CHT to accurately predict the cavity heating augmentation 
factors. Given the damage location and geometry, the BLT Mach number, the trajectory free 
stream flight conditions and the boundary layer parameters, the CHT uses a wind tunnel test- 
derived database to generate heating augmentation factors at every TMM node location 
requested at each time point in the trajectory. Damaged tile and/or repair materials will have 
different catalytic heating properties due to changes in surface properties. The Catalytic Heating 
Factor Prediction Tool (CHFT) provides additional augmentation heating factors as necessary to 
the TMM. Thermal analysis is then perfonned using the 3-D TMM. 
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Figure 9.2-3. Simple Aeroheating Tool Flow Diagram 

The 3-D TMM Tool was developed to take the aero thermal input and to predict the temperature 
response of Orbiter lower surface acreage TPS tile materials and structure. The 3-D TMM Tool 
temperature predictions are limited to lower Orbiter body surface acreage tile. The undamaged 
TPS tile accuracy is 5° F on the maximum structure temperatures as a result of uncertainties that 
can be attributed to the material thermal properties. Model accuracy will be affected by damage 
cavity geometry modeling (simplified cavity geometry). The tool is verified by arcjet test data as 
well as flight temperature measurements. 

The 3-D TMM Tool predicts time history of tile and structure temperatures and structural 
thermal gradients for areas with damaged tile. Exceedances of material temperature limits can 
be identified and tile bond pass/fail criteria for entry can be evaluated in a timely manner. 

A set of Special Configuration Math Model Tools (SCMMT) was developed to predict the 
temperature response of Orbiter tile and structure configurations. The damage sensitive areas 
are: perimeter seal locations around Orbiter doors, forward windows, forward vertical tail 
leading edge, forward reaction control canopy, and elevon lower cove. These Orbiter areas are 
kn own to not be damage tolerant for foam and ice impacts; therefore, thermal analyses pre- 
launch is not required and SCMMT are not applicable to development of flight rationale. The 
SCMMT are used only for on-orbit damage assessment. 

The Tile Stress and Bondline Integrity Tool is used in conjunction with the 3-D TMM to 
determine bondline failure at the tile to primary structure interface. They are performed using 
classical stress analysis methodologies. Stress analysis equations have been programmed to 
calculate entry FOSs for the lower surface 6” x 6” LI-900 HRSI (black) acreage tiles with 
damage oriented at 45 degrees. Failure modes include tension at the Room Temperature 
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Vulcanizing (RTV) bond, compression and shear in the LI-900, and shear in the Strain Isolation 
Pad (SIP). RTV bonds subjected to temperatures greater than 650°F are assumed to lose all 
tensile strength; however, the strength recovers after an initial reduction at temperatures between 
470°F and 650°F. 

Temperatures at thermal nodes from critical Mach numbers are superimposed on a tile damage 
map. Any areas of temperature greater than 650°F are simplified to a rectangular geometry and 
deleted from the bonded 5” x 5” footprint of the tile. Then, input aerodynamic pressures, 21.3 g 
(7.1 g’s at 3-sigma) vibro-acoustic dynamic loads, tile damage dimensions, loss of bond 
dimensions, material properties, and structural out-of-plane deflections are used to calculate 
corresponding FOS. 

The Structural Stress Assessment Models then use the output from the 3-D TMM to detennine 
the reduction in structural margin and increase of out-of-plane deflection due to increases in 
thermal gradient at the local damage site. This is conducted with classical stress analysis 
methodologies utilizing calculating thermal expansion. The local temperature increase resulting 
from Orbiter damage is converted into thermal loads, and is then used to analyze Orbiter stresses 
due to these loads. The tool is capable of combining the existing mechanical loads with the 
increased thermal loads to define structural margins of safety and out-of-plane deflections. 

There are several different models to represent the various types of Orbiter structure. The 
models are validated to FEM and hand calculations. 

The models are interconnected with a script which takes required input and transfers model 
output as required. The final product is Orbiter lower surface “damage map”, defining the 
maximum damage depth that can be tolerated in each of the 3 1 zones. The resulting damage 
thresholds are based on conservative, bounding, and certification rigor assumptions. Originally 
planned as the core rationale for acreage tile, this methodology has very limited use in the 
deterministic computation of C/E because the current 1 st generation damage map is so 
conservative in the calculation of C. Many damages incurred during flight history, which 
survived re-entry without identified vehicle degradation, exceeded the vehicle capability as 
identified in the certification rigor, or 1 st generation, damage tolerance map. However, the 
damage analysis tools and the resulting certification rigor damage map are still imbedded in the 
flight rationale in the Analysis of Historical Flight Damage (Section 9.3) and Probabilistic 
Assessment (Section 10.0) methodologies detailed below. Therefore, some discussion of their 
conservatism is appropriate. 

Sources of conservatism in this methodology include, but are not limited to: 

1 . The use of certification trajectory and re-entry parameters (Heavy Weight International 
Space Station (HWISS) return trajectory, maximum Orbiter weight, maximum G’s and 
si nk rate, End of Mission (EOM) sun, etc.). These types of conservatisms can be 
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significantly reduced for any given mission by using mission-specific parameters such as 
trajectories and weights. Operational constraints can also be imposed on G’s and si nk 
rate to reduce heating in contingency conditions. 

2. Non-case-consistent margins (minimum tile thickness, maximum heating and minimum 
structural margin for an entire zone @ one location). This is a practicality associated 
with having to analyze the entire lower vehicle surface. Areas of the vehicle are grouped 
by similar tile thickness and similar structural configuration. There are options available 
to reduce this conservatism, such as averaging minimum capabilities over a percentage of 
the zone, so as not to be inordinately penalized by a local minima or maxima across the 
entire zone. 

3. Damage cavity definition with a goal of exceedance of only 1/100 cavities (95 percent 
depth, 95 percent length, 95 percent width => 99 percent+ overall cavity volume; 
conservative wall angle assumptions). This conservatism is removed when these tools 
are used in an on-orbit scenario, as tile damage geometry becomes a measurable 
parameter from inspection. For a less conservative pre-flight assessment, percentages of 
test data enveloped could be reduced. Recommendations to reduce cavity definition 
parameters may be supported by the evaluation of actual flight data damage geometry, 
such as the “Platinum” dataset. 

4. Treatment of orientation and impact angle. A foam projectile is assumed to always 
impact in the worst possible orientation (smallest edge first) to induce the greatest 
amount of damage. An ice projectile is assumed to always impact in the worst 
orientation excluding a flat piece of ice impacting flat. This latter ice scenario was 
deemed unrealistic, as ice does not form in large flat sheets when attached to the Orbiter. 
Also if the projectile can hit with any orientation, then the probability of it hitting within 
12 degrees of flat is a low probability of occurrence (roughly 2-sigma). All projectiles 
are assumed to impact with a 90 degree beta angle (alpha is defined by the DTA). 

5. Tile bondline failure model simplifications and limited allowables drive many locations 
to premature bondline overtemperature and failure. These models conservatively locate 
tile damage in the center of the tile, so as to localize heating on one tile footprint. 

6. Aerothermal environments include several conservative assumptions. The cavity heating 
augmentation factors are based on rectangular cavities (90 degrees entrance / exit angles), 
which yield higher “bump factors”; catalytic heating factors bound rather than fit test 
data; BLT time is set to a bounding equivalent roughness that tends to initiate “early” 
transition. 

7. The 3-D TMM Tool does not simulate the individual 6” x 6” Orbiter tiles and has no 
inter-tile gap heating. This is accounted for with a conservative heating augmentation 
factor of 1.2. 
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9.2.2 Limitations and Gaps 

1 . The limitations and gaps in the development of the damage map, and its use in the flight 
rationale, are driven by the limitations and gaps of the individual tools. These are 
discussed in detail in Appendix C. 

9.2.3 Implications and Conclusions 

1 . Modeling methodology has been subjected to sufficient peer-review to understand the 
basic workings of all models, assumptions, limitations and key parameters passed 
between the models. Details on the functions, limitations and assumptions associated 
with each model are discussed in detail in Appendix C. 

2. The damage tolerance methodology used in the production of the 1 st generation damage 
map incorporates all the standard, certification rigor methodology and factors. Therefore, 
the reliability is believed to be quite high. 

9.2.4 Recommendations 

1 . Tool certification for use both in-flight and as a part of the flight rationale should include 
a thorough end-to-end validation. This validation should emphasize interfaces between 
tools, demonstrating understanding of modeling accuracy and uncertainty, as well as end- 
to-end correlation to both test and historical damage (in-work). 

2. Tile damage analysis models should be brought in-house to NASA to enable additional 
evaluation and independent tile damage risk trades through structured, parametric model 
sensitivity studies (in-work). 

3. The generation of a less conservative, predictive damage map should be produced for 
quantification of pre-flight risk of tile acreage catastrophic damage and compared to 
flight history for the purposes of model validation (in-work). 
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9.3 Analysis of Historical Flight Damage 

9.3.1 Assessment of the Engineering Data 

This methodology attempts to understand flight history, characterize historical damage, 
demonstrate the capability of models to recreate flight like damage, and incorporate 
improvements in the debris environment. 

Historical ascent damage is categorized into three families: 

1 . Popcoming Damage. 

2. Larger, Distributed Damage. 

3. ET umbilical Debris Environment. 

The methodology culminates in the analysis of seven representative scenarios. These scenarios 
are a combination of popcoming and divoting debris, and the resulting damage to the Orbiter 
TPS vehicle under a typical transport environment. 

Popcoming Damage 

The rationale provides sufficient data to show that the typical flight damage occurring along the 
chine/glove area is most likely traced to small, popcoming foam, primarily off the ET intertank 
acreage. A reasonable debris liberation model and reasonable DTA parameters utilized with 
both the 50 percent and 95 percent damage model produces a similar distribution of damages as 
seen in the flight history. The debris shedding frequency in the debris liberation model was 
developed on five flights worth of data, and the debris geometry was based on STS-95. The 
DTA looked at both nominal and no transport dispersions to understand sensitivity to dispersion 
and utilized typical dispersions (nominal drag, nominal lift and nominal pop off velocity) as a 
best representation of a “typical” flight. These “typical” transport parameters are then utilized 
with a foam debris “best estimate” and a 50 percent damage model to extrapolate typical debris 
damage that could be encountered on STS- 1 14. This damage is then compared to the 
certification rigor damage map to ensure that anticipated popcoming damage is within vehicle 
capability. 

9.3.2 Limitations and Gaps (Popcorning Damage) 

1 . The methodology for determining the popcorning debris environment (mass, frequency 
and Mach number) for STS- 1 14 extrapolations is unclear. 
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2. This methodology describes “typical” popcorning damage expected on a given flight. 
There is no rationale to define risk of a-typical damage, or to establish if historical 
damage covers a significant percentage of what could be encountered. Some sensitivity 
can be established through the use of a 95 percent damage map. However, it has been 
pointed out that this is only one-third of the debris, transport, capability computation, and 
defining the tails of the damage distribution, and is probably more accurately established 
at the system level. 

3. This assessment is based on the first revision of the “certification rigor” or “1 st 
generation” damage map. The tools which generate this map have been significantly 
updated since the NESC assessment was completed. 

Larger, Distributed Damage 

The cases of larger, distributed and less frequent impact damage are assumed to be from larger 
foam and ice debris. 

A forward extrapolation for STS- 1 14 large divots was conducted, similar to the work conducted 
on popcorning. However, five additional scenarios are developed which focus on larger debris 
sources from areas such as flanges, bipods, and ice/frost ramps. These scenarios are intended to 
be representative or typical, not necessarily bounding. Large debris source sizes are limited 
based on ta nk improvements and dissection data. Utilizing dissection data and expectations for 
improved performance based on redesign, all areas of potential larger foam liberation are shown 
good except the LO 2 ice/frost ramps. Even with limited debris size (0.007 lbm is used based on 
historical loss, versus 0.017 lbm maximum possible), the ice/frost ramps produce unacceptable 
damage in the forward part of the vehicle adjacent to the nose cap. While these comparisons are 
relative to the certification maps, some damage is projected to be equal to, or greater than, the 
thickness of the tile. Therefore, some relaxation on conservatisms will be required to show 
positive margins on even an improved capability map. 

When tile margin is evaluated for scenarios other than LCfi ice/frost ramps, there are still some 
areas with very low or negative capability. This may be inappropriately driven by Ogive foam 
popcoming, but that is uncertain based on the level of information available for review at this 
time. This marginal capability indicates that perhaps other foam/TPS source/target pairs should 
be treated in a probabilistic fashion to more accurately quantify the risk of catastrophic failure. 

9.3.3 Limitations and Gaps (Larger, Distributed Damage) 

1 . Arguments regarding ice are technically weak, and mostly anchored in simplistic 
attempts to correlate launches with high ice build-up to damage. From a lack of 
correlation, ice is assumed to not be a major contributor to damage. This conclusion 
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lacks substantive evidence and rigorous correlation efforts. It ignores the possibility that 
moderate ice launches may produce less dense ice which liberates more easily during 
ascent and actually causes greater damage. 

2. Some flight history data was presented to support the argument that the reduction in large 
divots from critical tank areas will “cut the tail off’ the distribution of damage depths and 
widths. However, the connection between the provided data and the desired conclusion 
is unclear. 

ET Umbilical Debris Environment 

Aft damage is characterized as being very repeatable and insensitive to events which have 

traditionally generated significantly more vehicle damage (i.e., STS-87). The damage is 

attributed to being dominated by recirculation effects in this area, and the debris source is the ET 

umbilical baggie and local ice. 

9.3.4 Limitations and Gaps (ET Umbilical Debris Environment) 

1 . While intuitively reasonable, the argument of the damage being due to the recirculation 
environment is circumstantial. The chaotic flow field would make any type of historical 
reconstruction impossible. 

2. If the hypothesis that the recirculation environment and the ET umbilical baggie and ice 
are the sources of damage is accepted as reasonable, then no evidence is offered about 
potential for non-typical debris damage; nor is the statistical representation of the 
population of damage seen thus far around the ET doors, or Orbiter capability to 
withstand typical damage in this area. 

9.3.5 Implications and Conclusions 

1 . A flight rationale has been constructed which gives confidence that for typical debris 
there is lower, but still unquantified probability, of a catastrophic hazard for foam on tile. 

2. The argument with regard to the probability of non-typical debris damage is lacking and 
does not sufficiently characterize the risk. 

3. With this methodology, the LCE ice/frost ramps continue to produce unacceptable 
damage (C/E significantly below 1). Therefore, the SSP will pursue a risk assessment 
analysis for this source/target pair. 
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9.3.6 Recommendations 

1 . The methodology for determining the popcorning debris environment (mass, frequency 
and Mach number) for STS- 1 14 extrapolations should be clearly documented. 

2. The “certification rigor” or “1 st generation” damage map should be updated to 
incorporate the baselined version of all the analysis tools (in work). These assessments 
should also be conducted again to ensure flight rationale remains valid. 

3. The flight rationale for tile damage needs to include a quantitative analysis of the risk 
from ET umbilical ice and baggie debris. 

4. All foam debris sources (including popcorning) should be incorporated into a 
probabilistic model for assessing the risk to tile from foam debris damage. This would 
describe the probability of having a non-typical debris damage event which is where the 
risk exists, not in typical debris damage. 

5. The flight rationale for seals and penetration needs to be updated, including the risk from 
popcorning debris. 

9.4 Probabilistic Flight Rationale 
9.4.1 Assessment of Engineering Data 

A Monte Carlo-based probabilistic model has been developed to establish the likelihood of 
producing LO 2 ice/frost ramp debris and resulting damage which exceeds the certification limits 
for tile. The details of this methodology are provided in Section 10.0. In this assessment, the 
damage generated by the debris is characterized as a distribution that is constructed from the 50 
percent damage model (mean fit of impact damage test data) and the 95 percent damage model 
(envelopes 95 percent of impact damage test data) with a Normal distribution. From a capability 
perspective, this methodology utilizes a certification rigor damage map to assess the capability of 
the vehicle. 


9.4.2 Limitations and Gaps 

1. The relationship between the 50 percent damage model and the 95 percent damage model 
is assumed to be a Normal distribution. 

2. From a capability perspective, this model utilizes the certification rigor damage map. 
Therefore, the same observations made in the Damage Tolerance section (Section 9.2) 
regarding the generation of this capability map apply. 
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9.4.3 Implications and Conclusions 

1 . From a capability perspective, this model utilizes the certification rigor damage map. 

Therefore, the same implications and conclusions made in the Damage Tolerance section 
(Section 9.2) regarding the generation of this capability map apply. 

9.4.4 Recommendations 

1 . Utilization of a Normal distribution to relate the 50 percent and 95 percent damage model 
should be verified from test data (Verified). 

2. A Monte Carlo-based probabilistic analysis that includes the distribution of foam defects 
as well as the Monte Carlo debris transport analysis should be conducted to determine the 
likelihood of an impact which exceeds the tile damage tolerance capability (In work). 

3. A more realistic approach to the Monte Carlo-based probabilistic analyses would 
incorporate a distribution for capability as well as environment. In the event that this 
type of distribution can not be readily established, a less conservative approach to the 
capability map could be generated (3 ld generation) that would provide a more realistic 
assessment of risk to the vehicle (In work). 

9.5 Accepted Risk Based on Previous Flight History 

This is the rationale presented for a family of debris sources for which the SSP has not 

determined damage tolerance. Mostly composed of booster separation motor (BSM) insulator 

and propellant debris, and SRB separation debris, these sources are on the order of 10' and 10' 

lbm. They are accepted strictly on their low mass, without analysis or test. 

9.5.1 Limitations and Gaps 

This rationale is based strictly on flight history, with no analysis or test. 

9.5.2 Implications and Conclusions 

1 . There is uncertainty associated with the lack of analysis and test for these small particles. 
While there an absence of engineering data to clear these items, the NESC concurs with the 
SSP’s prioritization and risk characterization. 
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9.6 Other (Tile Over Critical Seals and Penetrations) 

9.6.1 Assessment of the Engineering Data 

The OPO has provided an assessment of critical seals which are at risk of debris damage. This 
assessment examined special tile configurations associated with the following: 

1 . Main Landing Gear Doors (MLGD) 

2. Nose Landing Gear Doors (NLGD) 

3. ET Door 

4. Elevon Cove (EC) 

5. WLE Carrier Panels 

The impact and damage tolerance of seal areas is assumed to be identical to acreage areas except 
in overhang and lip areas (areas where tile extend out from structure unsupported). This is a 
conservative assumption as these perimeter tiles are tougher, denser FRCI-12 and LI-2200 
materials. Threshold velocity for damage to FRCI-12 has been demonstrated by test to be 
approximately 20 percent higher than LI-900. Impact limits within 1-inch from either side of the 
thermal barriers of the MLGD, NLGD and ET doors, and within 1-inch from the overhang on the 
forward elevon cove, have a maximum capability defined by the acreage tile impact tolerance 
(no damage) limits. There is no ice threshold for impact tolerance. Therefore, any ice impact 
within 1-inch of the thermal barriers for the MLGD, NLGD and ET doors, and within 1-inch 
from the overhang edge on the forward elevon cove tiles, is unacceptable. It is also assumed to 
result in critical damage. Ice impacts are also considered critical on the WLE carrier panels. 
These restrictions are supported by test results of both acreage and special configuration tile test 
articles. 

9.6.2 Limitations and Gaps 

1 . These conclusions are based on a very small number of tests. 

2. Arguments regarding the low likelihood of ET door damage on ascent are inconsistent 
with recirculation environment present in this area. 

3. The assessment lacks any determination of damage probability occurring in critical 
locations within 1-inch of seals and overhangs. 
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9.6.3 Implications and Conclusions 

The accepted risk for a debris impact to a critical seal or penetration is incomplete. 

9.6.4 Recommendations 

1 . Critical seal and penetration zones should be incorporated into the probabilistic 
assessment as separate zones. This would allow the extraction of impact probability 
which exceeds capability for these zones. This method of implementation would allow 
the probability of impacting a seal area to be rolled up in the overall probability of critical 
impact. 

2. The flight rationale for seals and penetration needs to be updated, including the risk from 
popcorning debris. 
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10.0 Probabilistic Analyses of Foam and Ice Debris Impacts on RCC and 
Tile 

10.1 Foam Debris Impact on RCC and Tile 

10.1.1 Assessment of Engineering Data 

The SSP contracted with The Aerospace Corporation to conduct an end-to-end Monte Carlo- 
based probabilistic analysis of the most critical ET foam debris cases. Only those debris cases 
with values of C/E “best estimate” below 1.5 will be analyzed (refer to Table 8.3-1). These are: 

- LO 2 and intertank ice/frost ramps 

- LO 2 intertank flange 

- LH 2 intertank flange 

- LO 2 PAL Ramp 

- Bipod Closeout 

Any potential foam debris from the LH 2 PAL Ramp and the LH 2 ice/frost ramps were enveloped 
by the above Monte Carlo probabilistic-based analysis of the LO 2 PAL ramp and LO 2 ice/frost 
ramps, respectively. Foam debris from the acreage areas were analyzed using the WOW 
analysis. Figure 10.1-1 depicts the foam locations and the respective analysis methods. 
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Figure 10.1-1. ET Tank Foam Area and Foam Debris Analysis Methods 


The Aerospace Monte Carlo methodology consists of five steps/models as outlined in Figure 
10.1-2. This methodology has been individually peered-re viewed. A brief summary of each 
model follows. 



Figure 10.1-2. Foam Debris Monte Carlo Analysis Methodology 
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The Foam Void Predictive Model randomly distributes voids within the foam based on foam 
void size and void number distributions. These distributions are based on the foam dissection 
database. 

The Foam Debris Generation Model is a physics-based model used to determine if a divot will 
form and, if so, its size, shape, mass, time of release and pop-off velocity. As part of the Monte 
Carlo probabilistic-based analysis, this model uses distributions of the foam material properties 
(strength, density, etc.). Two separate heating trajectories are used: nominal and hot. This 
model has been verified by ET Thermal Vacuum divot testing. 

The Foam Transport Model transports divots as a function of divot location, shape, mass, and 
pop-off velocity; vehicle ascent velocity; and atmospheric density. This model has been verified 
by comparison with high fidelity 6-DOF CFD solutions. 

The Orbiter Impact Algorithm Model utilizes a high fidelity model of the Orbiter to determine if 
a divot will impact the Orbiter based on the divot trajectory. 

The Orbiter Damage Analysis Model determines the Orbiter damage based on debris KE and 
Orbiter RCC material property distributions. 

10.1.2 limitations and Gaps 

The Monte Carlo methodology, input distributions, and physics models have all been 
independently peer-reviewed and verified by test data and/or independent analyses. However, 
the overall end-to-end Monte Carlo probabilistic-based analysis numerical results have not been 
independently reviewed. The limitations previously identified in Sections 3.2 and 3.5 also apply 
to the Monte Carlo probabilistic-based analysis. This limitation is not viewed as a constraint to 
RTF. 

10.1.3 Implications and Conclusions 

In general, the Monte Carlo analysis is conservative as the divot generation assumptions produce 
an excessive number of divots, the transport assumptions bias impact velocities are high, and the 
damage map allowables are survivable. The Monte Carlo results for each set of sources and 
targets are listed in Table 10.1-1. Due to the mathematical method used to aggregate the risks, 
the aggregate results are pessimistic. 
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Table 10.1-1. Foam Debris Risks For Nominal Trajectory 
(Source: Presented by the SSP at the DVR on June 24, 2005) 


^''\Source 

Ice/Frost 

lo 2 pal 

L0 2 Flange 

LH 2 Flange 

LH, 

Bi-Pod 

Aggregated 

Target 

Ramps 




Flange 

Cryo. 


Reliability 

Probability 

RCC 

>0.9999+ 

>0.9999+ 

>0.9999+ 

>0.9999+ 

>0.9999+ 

>0.9999+ 

>0.9999+ 

<1 in 10,000 

Standard Tile 

0.9976 

0.9999 

0.9997 

0.9999 

0.9999 

1.0000 

0.9971 

~1 in 350 

Special Tiles and 
Seals 

0.9962 

0.9999 

0.9963 

0.9999 

0.9999 

1.0000 

0.9925 

~1 in 130 

Aggregate 

0.9938 

0.9999 

0.9960 

0.9999 

0.9999 

1.0000 

0.9896 

~1 in 100 


10.1.4 Comparison of Monte Carlo results with Flight History 

The Aerospace Corporation Monte Carlo analysis identified the most likely contributor to foam- 
induced damage as the ice/frost ramps. However, the model predicted divoting at a much higher 
rate than had been previously documented from the ET separation photographs (only a single 3-4 
inch divot was identified in 161 post-ET-82 ramps that were imaged). Therefore, a review of 
the ET separation photos for ISS flights was performed by the NESC. Figure 10.1-3 shows the 
foam loss from ramps 5-9 for STS- 100. The figure contains circles scaled to 1, 2 and 3 inch 
diameter for size comparison. The photograph shows evidence of foam loss in the size range 
predicted by the Aerospace analysis. Ramps 6 and 7 each show multiple instances of foam loss. 

In addition to the single large ice/frost ramp divot (out of 161 ramps imaged) previously 
documented, the separation photos of ISS missions show fairly frequent small (on the order of 1 
to 3 inch diameter) losses of foam from the middle LCF ice/frost ramps. The rate of loss at these 
locations is in line with that predicted by the Aerospace Corporation in their Monte Carlo 
analysis. However, because the photographs show no foam loss from ramps lower on the LCF 
ta nk and on the intertank, the overall probability of not exceeding the allowable impact loads on 
tile is lower than that predicted by the Monte Carlo analysis. In a first order sense, the 
Aerospace results for tile impacts from ice/frost ramp divots are at most an order of magnitude 
conservative. 
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ramp 5 


ramp 6 



Figure 10.1-3. STS-100 Ice/Frost Ramps 5-9 


10.2 Analysis of Ice Debris Impact on RCC and Tile 
10.2.1 Assessment of Engineering Data 

The SSP contracted with Boeing to conduct an end-to-end Monte Carlo-based probabilistic 
analysis of expected ice debris from the feedline bellows, feedline brackets, and the umbilical. 
The locations of the feedline bellows, feedline brackets and umbilical, along with the flight 
rational methodology approach, are shown in Figure 10.2-1. Figures 10.2-2 and 10.2-3 show the 
specific location of the feedline bellows and brackets, respectively. Ice from the forward 
bellows, which has the greatest possibility of causing damage due to its forward location, has 
been mitigated by installation of a heater to prevent ice formation. Residual ice from the forward 
bellows is controlled by LCC. 
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XT 1129: 
XT 1377: 
XT 1623: 
XT 1871: 
XT 1923: 



Probabilistic 

Probabilistic Bracket I 

Enveloped (risk <1377) 
Enveloped (risk < 1377) 
Enveloped (risks 1377) 


Bellows ice 


XT 1109 (Fwd): LCC for residual ice 
XT 1979 (Mid): Probabilistic 
XT 2026 (Aft): Enveloped (risk < Mid) 


Design, Flight History 


Figure 10.2-1. Ice Source Locations and Flight Rationale Methodology 


Fwd Bellows XT1 106 Mid Bellows XT1979 Aft Bellows XT2026 



Figure 10.2-2. Feedline Bellows Locations and Bellows Ice Example 
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XT1129 XT 1 377 XT1623 XT1871 XT1923 




Bracket Example 


Figure 10.2-3 Feedline Bracket Locations and Bracket Ice Example 


To reduce the number of Monte Carlo simulations required to analyze bracket ice on tile, the 
SSP opted to apply a deterministic evaluation as a filter. Only ice on tile, which failed a 50 
percent tile damage depth, was further analyzed using Monte Carlo techniques. No rigorous 
engineering data or test data supports the use of 50 percent tile damage depth as an appropriate 
tile capability. 

The Boeing Ice Monte Carlo methodology consists of four steps/models as outlined in Figure 
10.2-4. This methodology has been individually peered-reviewed. A brief summary of the 
individual models follows. 



Figure 10.2-4. Ice Debris Monte Carlo Analysis Methodology 


The Ice Growth and Liberation testing has been performed on both a feedline bellows mock-up 
and a feedline bracket mock-up. These tests do provide an input for the maximum amount of 
debris released but, due to inherent limitations, cannot provide reliable mass distributions or rate 
of release data. The tests can be used comparatively to provide relative information. The mass 
distributions used in the Monte Carlo were bounding cases, and several rates of release 
distributions were used in a parametric study to provide sensitivities. 

The Ice Transport Model has been verified by comparison with NASA high fidelity 6-DOF 
CFD solutions. The transport model did not include rebounding ice particles off other surfaces 
(rebounding turned off). 
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The Orbiter Impact Algorithms utilize a high fidelity model of the Orbiter and algorithms in the 
BUMPER code. The BUMPER code has been independently verified. 

The Orbiter Damage Analysis determines Orbiter damage based on the foam impact damage 
map. For a given depth of damage, this provides a much greater width of damage than what is to 
be expected from flight history and experimental test data. Use of the foam impact damage map 
is conservative. 

10.2.2 Limitations and Gaps 

The physics of ice growth and resulting material properties, ice liberation, fracture, debris 
transport, and impact kinetic energy are currently not well understood. Furthermore, definitive 
test data to anchor the probabilistic analysis is not available. Therefore, the degree of uncertainty 
in the quantitative risk levels estimated by the probabilistic analysis will be difficult to quantify. 
Confidence in the results can be increased by using appropriate bounding estimates for the 
distribution and ice debris release times. 

No rigorous engineering data or test data supports the use of 50 percent tile damage depth as an 
appropriate tile capability filter. 

Ice on special tiles and seals were not analyzed. Ice from the umbilicals relied on flight history 
for a flight rationale basis. 

10.2.3 Implications and Conclusions 

Due to the inherent lack of knowledge of ice growth, fracture, and liberation, the Boeing Monte 
Carlo used bounding and conservative assumptions resulting in very conservative results in a 
parametric study. Assuming an exponential mass distribution and lift-off to unifonn rate of 
release distribution yields, the following probabilities are listed Table 10.2-1. 

Table 10.2-1. Summary of Ice Damage Monte Carlo Analysis 
(Source: Presented by the SSP at the DVR on June 24, 2005) 


Source 

Target 

Bracket 
XT 1129 

Bracket 
XT 1377 

Mid Bellows 
XT 1979 

Aft Bellows 
XT 2026 

RCC 

<1 in 100,000 

<1 in 1,000,000 

No transport 

No transport 

Standard Tile 

1 in 1,000 

1 ini 8 1 

1 in 100 

1 in 1,000 

Special Tiles 
and Seals 

No analysis 

No analysis 

No analysis 

No analysis 
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10.3 Summary of Foam and Ice Debris Monte Carlo Analyses 

The NESC participated in the peer-reviews of the Aerospace and Boeing analyses. These 
reviews included the methodologies being implemented in each analysis code and the input data 
used in the analyses. The end-to-end predictive capability of the Aerospace and Boeing 
probabilistic analysis codes, independently-developed, should be verified and validated. 
Ongoing peer-reviews are accomplishing the validation requirement, but more work is required 
for verification. The NESC suggests that verification could be achieved by comparing the 
analysis results from the two codes for a minimum of one debris case. 
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11.0 Hazard Analysis and Risk Assessment 

The 3x4 risk matrix shown in Figure 1 1.0-1 will be used to assign a risk level to each debris 
case. The Likelihood of Occurrence is assigned by assessing the controls that are in place to 
mitigate the risk. Severity is an assessment of the most severe hazard effects. Expected debris is 
classified as Catastrophic. Therefore, the key to assigning risk is the level of controls available 
to mitigate the risk. The controls available to mitigate foam debris are essentially those that are 
inherent in the ET design. A variety of controls are being evaluated to mitigate ice debris. The 
risk is a joint probability of the Likelihood and Severity. 

The levels of Likelihood of Occurrence are defined as follows: 

Probable: Expected to happen in the life of the program. Controls have significant limitations 
or uncertainties. 

Infrequent: Could happen in the life of the program. Controls have significant limitations or 
uncertainties. 

Remote: Could happen in the life of the program, but not expected. Controls have minor 
limitations or uncertainties. 

Improbable: Extremely remote possibility that it will happen in the life of the program. Strong 
controls in place. 

The levels of Severity are defined as follows: 

Marginal: Hazard could result in a mishap of minor nature inflicting first-aid injury to 
personnel and/or damage to flight or ground equipment which can be tolerated without abort or 
repaired without significant program delay. 

Critical: Hazard could result in serious injury to personnel and/or damage to flight or ground 
equipment which would cause mission abort or a significant program delay. 

Catastrophic: Hazard could result in a mishap causing fatal injury to personnel and/or loss of 
one or more major elements of the flight vehicle or ground facility. 

Tables 1 1.0-1 and 1 1.0-2 are summaries of the engineering data supporting the flight rationale 
for the RCC and the tile, respectively. Figure 1 1.0-2 shows the Orbiter RCC locations referred 
to in Table 1 1.0-1 and the Orbiter tile locations referred to in Table 1 1.0-2. The interpretation of 
these data will result in the assignment of each debris case to a risk level. 
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11.1 Risk Assessment for Foam Debris 

The Aerospace Corporation has conducted Monte Carlo-based probabilistic analyses of the most 
severe foam debris sources (LCL ice/frost ramp, LO 2 intertank flange, LH 2 intertank flange, LO 2 
PAL Ramp, and Bipod Closeout). The Aerospace Monte Carlo-based probabilistic model used 
methodologies that have been peer-reviewed and validated by comparison to other analysis 
results and ground test data. In addition, the input distributions used in the analyses have also 
been peer-reviewed. However, the overall end-to-end Monte Carlo analysis has not been 
verified. One potential verification method would be a comparison of flight history with a 
Monte Carlo analysis for the LH 2 intertank flange with the previous foam design. While the 
end-to-end predictive capability (numerical results) has not been verified, the results of 
sensitivity studies and comparison to flight data suggest that the results are conservative. 
Based on the results of these analyses and an assessment of the controls for each foam source, 
the NESC concurs with the SSP that the likelihood of debris from each foam source exceeding 
the critical impact capability for RCC is Improbable. The NESC concurs with the SSP that the 
likelihood of foam debris exceeding the critical impact capability of Tile is either Remote or 
Infrequent, depending on the foam source. The highest computed risk is for tile seals and 
penetrations, which is not overly conservative relative to flight history, and furthermore, has not 
been fully characterized. The NESC has concluded that the probabilistic results, 
supplemented by additional engineering data, physics considerations, and the level of 
control over debris liberation, provide a reasonable engineering foundation for a flight 
rationale for STS-114 based on accepted risk due to expected foam debris. 

11.2 Engineering Considerations that Support the Flight Rationale for Foam Debris 

1 . The bipod ramp was eliminated and several manual spray closeouts were redesigned (the 
bipod closeout, the first ten feet of the LH 2 ta nk PAL ramp, and the LH 2 tank-to-intertank 
flange closeout). 

2. ET automated spray foam (LO 2 , LH 2 , and intertank acreage) debris sources have been 
eliminated from concern for all Orbiter RCC and tile locations by the certification rigor 
(WOW) deterministic analysis. Also, some Orbiter WLE RCC panels and tile locations 
can be eliminated from concern using the WOW or best estimate deterministic analyses 
for all foam debris sources. 

3. Divot/no-divot cohesive failure methodology is conservative. (Test panels contained 
artificially machined voids with cut edge rather than natural voids. The idealized void 
geometry in the divoting tests are worst-case simulations of the actual orientations of 
naturally occurring voids in foam. Also, the failure curve is bounding to all divot data 
which is conservative for densities greater than the minimum). 
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4. Component tests with flight hardware geometry (geometry of intertank flange regions) 
and simulated flight loads environment did not divot, for both as-sprayed foam panels 
and panels with artificially-induced voids. 

5. Component qualification tests for redesigned bipod closeout region did not liberate large 
divots (test panels were as-sprayed foam, no artificially-induced voids). Voids in 
qualification test panels are smaller than some of the voids in similar locations found in 
the V&V section data. 

6. Tile capability map used in the C/E deterministic calculations and in the probabilistic 
analyses are conservative. 

7. Flight history demonstrates damage tolerant attributes of tile. 

8. Physics of cohesive failure of foam, debris transport analysis, and Orb iter impact 
capability are well characterized and experimentally verified. 

9. Distributions and assumptions used in the end-to-end probabilistic analyses render a 
moderate-confidence upper bound risk assessment. (For some debris sources, 
probabilistic analysis may be inconsistent with past flight history). 

10. Ascent and on-orbit assessment capability for STS-1 14 and repair capability on future 
flights has the potential to mitigate risk. 

11.3 Risk Assessment for Ice Debris 

The Boeing Company conducted Monte Carlo-based probabilistic analyses of ice debris from the 
ET feedline bellows at the forward, mid, and aft locations, and at the ET feedline brackets at 
locations 1 129 and 1377. (Ice debris from ET umbilicals has not been rigorously analyzed). 
While ice liberation tests of a feedline bracket have been conducted, the limited results do not 
provide an adequate test basis for building distributions of the debris mass. Furthermore, 
limitations in simulating the actual flight environment cast a doubt over the suitability of the test 
results to establish the time of ice debris release. Therefore, several different distributions of 
mass debris and several scenarios of time of release were used to estimate the probability of ice 
debris exceeding the Orbiter critical impact capability. A less conservative tile damage 
capability allowable (50 percent damage depth) was used in the ice analysis rather than the foam 
analysis. (This is unacceptable for deterministic analyses). The results indicate that the 
estimated likelihood of exceeding the critical damage capability for the RCC is Improbable. The 
estimated likelihood of exceeding the critical damage capability for tile is very high (Probable or 
Infrequent). (Seals and penetrations were not explicitly addressed in the probabilistic analyses). 
However, the Monte Carlo analysis results vary by three orders of magnitude, depending on 
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the input mass distribution assumption and the scenario for time of release, which could result in 
the risk being classified anywhere from Probable to Remote. In addition, a relative comparison 
between the bellows ice liberation test and the bracket ice liberation test suggests that 
significantly more ice is liberated from the bellows than from the bracket. Therefore, a 
reasonable qualitative argument can be advanced that eliminating the bellows ice has 
significantly lowered the overall risk to tile from ice debris. Based on the available test data 
and analysis results, the NESC has concluded that the feedline brackets and ET umbilical 
ice debris environment is not sufficiently characterized or understood to assign the level of 
risk. 

11.4 Engineering Considerations that Supports the Flight Rationale for Ice Debris 

1 . Installed heater on the forward bellows to eliminate ice formation. (The heater at the 
forward bellows has eliminated half the ice sources at the forward most ice debris 
location.) Ice debris risk to WLE RCC panels has been significantly mitigated. 

2. Bracket ice liberation tests suggest debris mass is small compared to forward bellows. 
Bracket geometry appears to constrain total mass liberated. 

3. Conservative assumptions about ice debris mass distributions and time of release results 
in bounding probability values (approximately 1 in 300), which are lower than the value 
(approximately 1 in 200) for forward bellows prior to installing the heater. 

4. Ice characterization tests have provided an understanding for evaluating ta nk ice and can 
be used to a limited extent to assess ice on the lower side of the bracket (the only view 
currently visible) and upper side of the bracket. 

5. Tile damage capability map is conservative. 

6. On-orbit assessment capability for STS-1 14 and repair capability on future flights has the 
potential to mitigate risk. 

7. Flight history demonstrates damage tolerant attributes of tile. 

8. Only a small fraction of recorded damage cases to tile appear to be from ice debris. 

9. LCC controls have the potential to limit the total amount of ice prior to launch (at least 
can tell the difference qualitatively between heavy ice and light ice). 
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11.5 Recommendations 

1 . An evaluation of effective controls of ice debris from the ET umbilical ice should be 
completed prior to STS-1 14 and implemented via Launch Commit Criteria (LCC). 

2. An evaluation of effective controls of ice debris from the feedline brackets should be 
completed prior to STS-1 14 and implemented via Launch Commit Criteria (LCC). In 
addition, risk mitigation methods that can be implemented for subsequent missions to 
reduce overall program risks should be pursued as a high priority. 

3. Focus the flight test objectives to obtain engineering data during STS-1 14 to characterize 
the ice debris environment for the ET feedline brackets at locations 1 129 and 1377, mid 
bellows, and ET umbilical. Additional ground tests should be conducted to supplement 
the flight test data. 

4. The end-to-end predictive capability of the Boeing and Aerospace probabilistic analysis 
codes, which were independently-developed, should be verified. One approach to 
achieving this verification is to compare the analysis results from the two codes for at 
least one debris case. 
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Figure 11.0-1. Hazard Severity and Likelihood of Occurrence with Controls in Place 
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Table 11.0-1. Critical Damage to Orbiter RCC and Tile to Expected Foam and Ice Debris from External Tank 


Debris Sources by 
Tank Location 

Redesigned or 
“Fly-as-is” 

Is Large 1 Foam 
or Ice Loss 
Physically 
Realistic? 
(Yes/No) 

Flight 
Evidence of 
Previous 
Foam or Ice 
Loss? 
(Yes/No) 

C/E 

Certification 
Methodology 
(SSP DVR 
Values) 

C/E 

“Best Estimate” 
Methodology 
(SSP DVR 
Values) 

C/E 

“Best Estimate” 
Methodology 
(NESC 
Values) 

Monte Carlo- 
Based 

Probabilistic 
Assessment 
(SSP DVR 
Values) 

Monte Carlo- 
Based 

Probabilistic 
Assessment 
(SSP DVR 
Values) 2 

WLE 

Panels 

10-12 

Nose Cap/ 
Chin Panel 

WLE 

Panels 

10-12 

Nose Cap/ 
Chin Panel 

WLE 

Panels 

10-12 

Aggregated All 
RCC 

Aggregated All 
Tile 

L0 2 Flange 
Foam 

“Fly-as-is” 

Yes 

No 

0.36 

0.29 

1.1 

1.1 

0.9 

<1 in 10,000 

1 in 250 

LH 2 Flange 3 
Foam 

Redesigned 

Yes 

No Data 

0.39 

No TM 4 

1.8 s 

No TM 

1.4 

<1 in 10,000 

1 in 10,000 

L0 2 Ice/Frost Ramps 
Foam 

“Fly-as-is” 6 

Yes 

Yes (1) 

0.24 

0.12 

1 . 0 10 

0.61 

0.5 9 

<1 in 10,000 

1 in 160 

Intertank Ice/Frost 
Ramps Foam 

“Fly-as-is” 

Yes 

No 

0.28 

0.52 

1.5 10 

3.2 

o 

bo 

SO 

Included in L0 2 
I/F 

Included in L0 2 
I/F 

LH 2 Ice/Frost Ramps 
Foam 

“Fly-as-is” 7 

Yes 

Yes (12) 

0.38 

No TM 

1.6 10 

No TM 

0.9 9 

Enveloped 

Enveloped 

L0 2 PAL Ramp 
Foam 

“Fly-as-is” 

Yes 

No 

0.41 

0.26 

1.7 

1.6 

1.4 

Enveloped 

1 in 10,000 

LH 2 PAL Ramp Foam 
Forward 

Redesigned 8 

Yes 

No Data 

0.39 

No TM 

2.0 

No TM 

1.6 

Enveloped 

Enveloped 

Aft 

“Fly-as-is” 

Yes 

Yes (2) 

0.40 

No TM 

1.9 

No TM 

1.6 

Enveloped 

Enveloped 

Bipod Closeout 
Foam 3 

Redesigned 

Yes 

No Data 

0.37 

No TM 

l.l 5 

No TM 

0.9 

<1 in 10,000 

<1 in 10,000 

1377 Feedline 
Bracket Ice 

“Fly-as-is” 

Yes 

No Data 


No TM 


No TM 


<1 in 1,000,000 

1 in 181 

1129 Feedline 
Bracket Ice 

“Fly-as-is” 

Yes 

No Data 


No TM 


No TM 


<1 in 100,000 

1 in 1,000 

Mid (1979) Feedline 
Bellows Ice 

Redesigned 

Yes 

Yes 

No TM 

No TM 

No TM 

No TM 

No TM 

No TM 

1 in 100 

Aft (2026) Feedline 
Bellows Ice 

Redesigned 

Yes 

Yes 

No TM 

No TM 

No TM 

No TM 

No TM 

No TM 

1 in 1,000 


1 Excludes small mass debris such as popcoming. 

2 Includes seals and penetration for foam, but not for ice. 

3 Susceptible to cryoingestion (nitrogen purge at intertank). 

4 No Transport Mechanism (TM). 

5 Cryoingestion and cryopumping failure mechanisms not included in “best estimate” E. 

6 Material changed on STS-79. 

7 Process improved beginning on ET-1 12. 

8 Massive aero ramp eliminated, foam applied at base of fitting. 

9 PDL high density foam adjustment 20 percent (a factor of 0.8 is used on KE). 

I0 NESC cannot reproduce these computed numbers. 


NESC Request No. 05-010-E 


Table 11.0-2. Characterization of Foam Debris, DTA, and Capability Data for Damage to Tile 


Orbiter 

Location 

Location 
tSee Figure 
11.0-2') 

Cert-WOW- 

Cert 1 

Ult-WOW- 

Cert 2 

Typical-Typical- 
Cert (95%) 3 

Typical-Typical- 
Cert (50%) 4 

Typical-Typical- 
Cert (95% w/o I/F 
ramp) 5 

Forward 

BP 1100 

0.19 

0.21 

0.39 

0.40 

1.04 



BP 1050 

0.21 

0.24 

0.34 

0.45 

3.21 



BP 1074 

0.13 

0.15 

0.26 

0.41 

1.07 



BP 2202 

0.24 

0.29 

0.60 

0.31 

0.95 



BP 1202 

0.13 

0.15 

0.34 

0.71 

1.64 



BP 1304 

0.33 

0.39 

1.27 

0.54 

2.38 



BP 1351 

0.06 

0.07 

0.35 

1.76 

3.92 



BP 2305 

0.33 

0.39 

1.38 

0.47 

1.16 



BP 1450 

0.07 

0.08 

0.39 

1.77 

3.81 



BP 2004 

0.13 

0.15 

0.58 

0.54 

1.76 



BP 1607 

0.42 

0.50 

2.49 

0.76 

1.42 



BP 2340 

0.12 

0.14 

0.98 

3.45 

4.31 



BP 1602 

0.05 

0.06 

1.35 

1.75 

3.33 



BP 1600 

0.07 

0.13 

20.00 

2.44 

1.59 



BP 2420 

0.39 

0.46 

2.62 

HIGH 

20.00 



BP 2350 

0.11 

0.13 

1.85 

3.83 

4.55 



BP 1702 

0.12 

0.14 

3.28 

5.56 

2.82 



BP 1700 

0.07 

0.10 

16.67 

HIGH 

3.28 



BP 2620 

0.24 

0.28 

2.72 

HIGH 

16.67 



BP 1800 

0.09 

0.10 

2.46 

7.14 

4.72 



BP 2820 

0.51 

0.60 

11.36 

HIGH 

2.46 



BP 2750 

0.14 

0.16 

3.73 

142.86 

22.22 



BP 2540 

0.13 

0.16 

3.42 

50.00 

3.73 


r 

BP 2370 

0.09 

0.12 

2.34 

10.42 

3.42 

Aft 

BP 1851 

0.11 

0.13 

3.49 

7.14 

2.34 


I < 1.0 


< 2.0 


1 Certification limit from NSTS 07700 determines size debris liberated into WOW dispersed trajectory with resulting damage based on a 95% damage model and compared to certification rigor capability map (i.e., 1 st generation). 

2 Ultimate divot-no divot curve determines size of debris liberated into WOW dispersed trajectory with resulting damage based on a 95% damage model and compared to certification rigor capability map. 

3 “Best estimate” of expected foam debris based on 7 SE&I defined scenarios with liberation into nominal lift, nominal drag and nominal pop off velocity transport with resulting damage based on a 95% damage model and 
compared to certification rigor capability map. 

4 Same as 3, except damage based on a 50% damage model. 

5 Same as 3, except removal of 3 scenarios dealing with typical ice/frost ramp debris 
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Cap and Chin Panel 
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12.0 Conclusions and Recommendations 

Since the loss of Columbia on February 1, 2003, the Space Shuttle Program (SSP) has 
significantly improved the understanding of launch and ascent debris, implemented hardware 
modifications to reduce debris, and conducted tests and analyses to understand the risks 
associated with expected debris. The STS- 1 14 flight rationale for expected debris relies on a 
combination of all three of these factors. 

A number of design improvements have been implemented to reduce debris at the source. The 
External Tank (ET) thermal protection system (TPS) foam has been redesigned and/or process 
improvements have been implemented in the following locations: the bipod closeout, the first 
ten feet of the liquid hydrogen (LFB) ta nk protuberance air load (PAL) ramp, and the LEE tank- 
to-intertank flange closeout. In addition, the forward bipod ramp has been eliminated and 
heaters have been installed on the bipod fittings and the liquid oxygen (LO 2 ) feedline forward 
bellows to prevent ice formation. The Solid Rocket Booster (SRB) bolt catcher has been 
redesigned. The Orbiter reaction control system (RCS) thruster cover “butcher paper” has been 
replaced with a material that sheds at a low velocity. Finally, the pad area has been cleaned to 
reduce debris during lift-off. 

The understanding of the sources and mechanisms that produce foam debris was established by a 
rigorous root cause investigation and the dissection of significant sections of foam removed from 
flight-ready ETs. Quantifying the risk associated with debris has been a major challenge. 
Activities included tests and analyses to predict expected/possible debris, transport tests and 
analyses to define debris trajectories and the velocity at impact, and tests and analyses to 
determine the impact capability of the Orbiter TPS components. These tests and analyses have 
addressed all types of ET foam and tank locations, ice from several locations on the ET, and 
butcher paper from the RCS thruster cover. 

The SSP requested that the NASA Engineering and Safety Center (NESC) conduct a peer-review 
of the flight rationale for expected debris. The NESC assembled a multi-disciplinary team of 
subject matter experts to address each component of the proposed flight rationale. The team 
reviewed the debris sources data, transport test and analysis data, Orbiter impact capability test 
and analysis data, and the overall methodology to establish flight rationale and associated risks. 
The NESC peer-review began with the element level certification activities in 2004 and 
continued through the development of the end-to-end Space Shuttle System (SSS) level flight 
rationale in 2005. The NESC team has been working closely with the SSP team and has 
provided numerous recommendations throughout the review process on possible areas of 
improvement to the foam spray process, hardware redesign, and in quantifying the risks 
associated with expected debris. Virtually, all of the NESC recommendations have been 
implemented by the SSP team. This report documents the findings of the NESC peer-review of 
the flight rationale logic and conclusions. (Previously issued NESC position papers documented 
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the findings and recommendations regarding element level certification for expected debris). 
Provided below is a summary of the NESC findings for the principle elements of the flight 
rationale. The conclusions and recommendations are highlighted. 

Physics of Foam Debris Generation: Each foam location on the ET has been assessed for 
susceptibility to large foam loss based on physical arguments about the type of foam, and the 
void temperature and pressure conditions during ascent. The large acreage locations, where the 
automated spray method is used, were eliminated from concern since no voids were found in 
these areas during dissection of foam on ta nk ET-94. Other locations can contain voids which 
have leak paths and may be susceptible to cryoingestion or cryopumping, depending on their 
location on the ta nk and the thickness of the foam. Divoting from sealed voids due to 
thermal/vacuum conditions is the most likely source of foam debris and can occur in every 
location on the ta nk with manually applied foam. The NESC concluded that an analysis of 
each specific location on the tank that takes into account the local temperature, pressure, 
and location of voids is a valid method for determining the most likely divoting mechanism 
for each ET foam debris case. 

“Worst-on-Worst (WOW) Estimate” of the Impact Capability Margin (C/E): The WOW 

estimate of the C/E is actually the certification rigor methodology for structural design. C is the 
capability of TPS to survive the impact and E is the debris environment, both quantified in 
kinetic energy (KE) for impacts to the RCC and velocity for impacts to tile. The WOW estimate 
includes a 1.4 factor of safety (FOS) on C and a 1.25 FOS on E. The methodology compounds 
conservatisms that are included in each of the three analyses (debris liberation, debris transport, 
and impact capability) that must be combined to estimate the C/E. The minimum predicted 
impact C/E is well less than 1 .0 for many WLE RCC panels, the RCC nose cap and chin panel, 
and many tile locations. Therefore, the locations of the Orbiter with a C/E less than 1.0 are 
not certified for expected debris using the standard WOW approach. To further address 
these locations, a “best estimate” approach was used to compute a less conservative estimate of 
the C/E. In addition, a Monte Carlo-based probabilistic analysis was used to quantify the risk for 
the most difficult cases. 

“Best Estimate” of the Impact Capability Margin (C/E): The “best estimate” is a quasi- 
deterministic method. The capability and expected debris mass are point-values; and the debris 
transport analysis is the result of a Monte Carlo simulation. All FOSs used in the certification 
methodology are removed from the estimates of C and E. In addition, the expected debris mass 
has been reduced to the smaller mass debris due to the sealed voids divoting mechanism. The 
NESC concurs that the “best estimate” method is less conservative than the “WOW estimate” 
and is useful in understanding the level of risk due to expected foam debris. The system level 
FOS should be at least 1.4, if all other FOSs are removed from the C and E estimates. A 
number of debris cases for RCC and tile do not have an impact C/E greater than 1.4 based 
on the “best estimate” method and several locations are below 1.0. 
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Recommendation #1: The NESC concurs with the Delta System Design Verification Review 
(DVR) (April 26-27, 2005) finding that an end-to-end Monte Carlo-based probabilistic 
analysis will be conducted for the foam debris cases that do not have a “best estimate ” impact 
C/E of at least 1.4. 

ET Foam Debris Environment (E): The cryopumping and cryoingestion divoting mechanisms 
are included in the “WOW estimate”, but not included in the “best estimate” of the debris mass. 
Divoting from cryopumping requires a “smart” leak path that is large enough to allow a void to 
fill with condensed air during the pre-launch hold, but is small enough to preclude venting as the 
air is vaporized during ascent. The results of component level tests simulating the flight 
environment support the supposition that divoting from cryoingestion and cryopumping are 
highly unlikely to occur. Therefore, the “best estimate” values of E are based on the smaller 
mass, but more likely debris caused by the sealed void divoting mechanism. The NESC concurs 
with the logic of not including cryoingestion and cryopumping in the “best estimate” of E used in 
the impact C/E because this is a quasi-deterministic method. However, all divoting mechanisms 
and all void data must be included in the Monte Carlo-based probabilistic analysis. 

Recommendation #2: Cryoingestion should be included in the Monte Carlo-based 
probabilistic analysis of the debris cases that do not satisfy the system level “best estimate ” 
impact C/E of at least 1.4. 

Impact Capability (C) for RCC: The value of impact capability that corresponds to the onset 
of damage in RCC (or the NDE threshold for detectable damage) is a requirement, and should 
not be thought of as a knockdown factor to account for an uncertainty. The damage onset 
requirement was established by the arcjet burn- through tests and the analysis of the WLE and 
nose cap. The SSP based the “best estimate” value of C on only the as-fabricated properties of 
the RCC test panels. The NESC reviewed the engineering data and concluded that the value of C 
used in the “best estimate” must account for both expected material variability and end-of-life 
aged RCC. Therefore, the NESC computed values of the “best estimate” impact C/E are 
approximately 20 percent lower than the SSP values. In addition, the nose cap geometry and 
material are significantly different from the WLE RCC panels. No impact tests or arcjet bum- 
through tests have been conducted on the nose cap geometry or material. The impact capability 
margins (estimated to be less than 1.0) for the nose cap and chin panel are based only on 
analytical results from math models that have not been verified to be accurate for the nose 
cap geometry and material. 

Recommendation #3: The “ best estimate” value of C should be computed using material 
properties that accounts for material variability inherent in RCC and the end-of-life aged 
RCC properties. 
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Recommendation #4: Impact tests and arcjet tests should be conducted on the nose cap 
geometry and material to verify the analysis methodology and results used to develop the flight 
rationale. 

RCC Burn-Through and Hole Growth Damage Requirements: After reviewing the 
engineering data supporting the RCC burn-through requirements and the RCC Damage Growth 
Tool used to develop the nose cap and WLE damage maps, the NESC concurs that the arcjet data 
is adequate to establish the RCC impact damage requirement for re-entry of STS-1 14 (0.020" 
coating loss for time to breach, and 0.020" coating loss plus a mid-plane delamination for hole 
growth). However, the experimental data from the stagnation flow arcjet tests are not sufficient 
to validate the tool for all impact damage cases and for vehicle locations subjected to crossflow 
flight conditions. Stagnation flow arcjet tests are a reasonable simulation of the nose cap flow 
conditions whereas properly designed wedge flow arcjet tests are a better simulation of the 
crossflow flight conditions of the WLE. Therefore, the level of conservatism, uncertainty in 
results, and limitations on the use of the tool cannot be established for all vehicle locations and 
damage cases. Because of this shortcoming, the current tool should only be used by experienced 
subject matter experts such as the tool developers. Specifically, caution must be exercised in 
using this tool to predict hole growth. 

Recommendation #5: Additional arcjet tests with specimens containing actual impact damage 
rather than simulated impact damage, particularly wedge flow tests, are required to establish 
the level of conservatism in using the RCC Damage Growth Tool for all vehicle locations and 
impact damage cases. 

Past Flight History: The data on debris generation and impact damage recorded from previous 
flights provides a compelling basis for a flight rationale for Orb iter acreage tile. However, it has 
less relevance for impacts on the Orbiter RCC. The recorded incidents of foam debris generation 
are documented from a limited number of cameras. So this information lacks the fidelity 
required to precisely define the debris mass. Also, a large database (about 14,000 cases) of 
actual damage to tile has been recorded over the life of the Orbiters. A subset of about 300 
damage cases, referred to as the platinum dataset, are adequately documented to provide a 
benchmark for the computational methodology developed to predict tile damage. The NESC 
concluded that the platinum dataset is also a valid basis for supporting the flight rationale. 

Tile and Structural Capability Models: A suite of Math Model Tools (Damage, Aerothermal, 
Thermal and Structural Analysis Tools) are utilized to describe the capability of the acreage 
Orbiter tile and structure. This description of capability is documented as a “damage map” and 
is utilized in various forms and versions throughout the flight rationale. The tools have been 
subjected to peer-review to understand the basic workings of all tools, assumptions, limitations 
and key parameters passed between the tools. The methodology, used in the production of the 
“certification rigor” or “1 st generation” damage map, incorporates all the standard certification 
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rigor methodologies and factors. Therefore, the conservatism of the capability established is 
believed to be quite high. 

Recommendation #6: Certification of tools for both in- flight and as a part of the flight 
rationale should include a thorough end-to-end validation. This validation should emphasize 
interfaces between tools, demonstrating understanding of modeling accuracy and uncertainty, 
as well as end-to-end correlation to both test and historical damage. 

Recommendation #7: The generation of a less conservative, predictive damage map should be 
produced for quantification of pre-flight risk of tile acreage catastrophic damage and 
compared to flight history for the purposes of model validation. 

Flight Rationale for Tile: Both the “WOW” and “best estimates” of the impact C/E for many 
tile locations are considerably less than 1.0. However, the Math Model Tools used to estimate 
these impact C/Es also conservatively overestimates the severity of some damage cases 
previously recorded in the flight history database. Flight history clearly illustrates the damage 
tolerance capability of acreage tile. Therefore, a flight rationale has been constructed which 
gives increased confidence in our understanding of the debris environment and indicates that for 
typical debris there is not a catastrophic hazard for foam impacts on tile (excluding seals and 
penetrations). However, the use of flight history is not sufficient to characterize the accepted 
risk if several cases of severe impact damage occurring in a noncritical tile location had occurred 
to a more critical close-by tile location. 

Recommendation #8: A Monte Carlo-based probabilistic analysis that includes the 
distribution of foam defects as well as the Monte Carlo debris transport analysis should be 
conducted to determine the likelihood of an impact which exceeds the tile damage tolerance 
capability. 

Risk Assessment for Foam Debris: The Aerospace Corporation has conducted Monte Carlo- 
based probabilistic analyses of the most severe foam debris sources (LCE ice/frost ramp, LO 2 
intertank flange, LH 2 intertank flange, LO 2 PAL Ramp, and Bipod Closeout). The Aerospace 
Monte Carlo-based probabilistic model used methodologies that have been peer-reviewed and 
validated by comparison to other analysis results and ground test data. In addition, the input 
distributions used in the analyses have also been peer-reviewed. While the end-to-end 
predictive capability (numerical results) has not been verified, the results of sensitivity 
studies and comparison to flight data suggest that the results are conservative. Based on the 
results of these analyses and an assessment of the controls for each foam source, the NESC 
concurs with the SSP that the likelihood of debris from each foam source exceeding the critical 
impact capability for RCC is Improbable. The NESC concurs with the SSP that the likelihood of 
foam debris exceeding the critical impact capability of Tile is either Remote or Infrequent, 
depending on the foam source. The highest computed risk is for tile seals and penetrations, 
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which is not overly conservative relative to flight history, and furthermore, has not been fully 
characterized. The NESC has concluded that the probabilistic results, supplemented by 
additional engineering data, physics considerations, and the level of control over debris 
liberation, provide a reasonable engineering foundation for a flight rationale for STS-114 
based on accepted risk due to expected foam debris. 

Recommendation #9: The risk assessment for seals and penetration should be completed, 
including the threat from popcorning foam debris and ice debris. 

Risk Assessment for Ice Debris: The Boeing Company has conducted Monte Carlo-based 
probabilistic analyses of ice debris from the ET feedline bellows at the forward, mid and aft 
locations and the ET feedline brackets at locations 1 129 and 1377. (Ice and baggie debris from 
ET umbilicals has not been rigorously analyzed). While ice liberation tests of a feedline bracket 
have been conducted, the limited results do not provide an adequate test basis for building 
distributions of the debris mass. Furthermore, limitations in simulating the actual flight 
environment cast a doubt over the suitability of the test results to establish the time of release of 
the ice debris. Therefore, several different distributions of mass debris and several scenarios of 
time of release were used to estimate the probability of ice debris exceeding the Orbiter critical 
impact capability. A less conservative tile damage capability allowable (50 percent damage 
depth) was used in the ice analysis than the foam analysis. (This is unacceptable for 
deterministic analyses). The results indicate that the estimated likelihood of exceeding the 
critical damage capability for the RCC is Improbable. The estimated likelihood of exceeding the 
critical damage capability for tile is very high (Probable or Infrequent). (Seals and penetrations 
were not explicitly addressed in the probabilistic analyses). Flowever, the Monte Carlo analysis 
results vary by three orders of magnitude, depending on the input mass distribution assumption 
and the scenario for time of release, which could result in the risk being classified anywhere 
from Probable to Remote. In addition, a relative comparison between the bellows ice liberation 
test and the bracket ice liberation test suggests that significantly more ice is liberated from the 
bellows than from the bracket. Therefore, a reasonable qualitative argument can be advanced 
that eliminating the bellows ice has significantly lowered the overall risk to tile from ice debris. 
Based on the available test data and analysis results, the NESC has concluded that the 
feedline brackets, bellows, and ET umbilical ice debris environment is not sufficiently 
characterized or understood to assign the level of risk. To establish the flight rationale for 
STS-114, additional work is required to develop adequate controls for ice. 

Recommendation #10: A physics-based engineering analysis of the risk to tile from ET 
umbilical ice and baggie debris should be conducted to ensure that adequate impact capability 
exists for impact scenarios consistent with past flight environment. 

Recommendation #11: An evaluation of effective controls of ice debris front the ET umbilical 
ice should be completed prior to STS-114 and implemented via Launch Commit Criteria 
(LCC). 
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Recommendation #12: An evaluation of effective controls of ice debris from the feedline 
brackets should be completed prior to STS-114 and implemented via Launch Commit Criteria 
(LCC). In addition, risk mitigation methods that can be implemented for subsequent missions 
to reduce overall program risks should be pursued as a high priority. 

Recommendation #13: Focus the flight test objectives to obtain engineering data during STS- 
114 to characterize the ice debris environment for the ET feedline brackets at locations 1129 
and 1377, mid bellows, and ET umbilical. Additional ground tests should be conducted to 
supplement the flight test data. 

Recommendation #14: The end-to-end predictive capability of the Boeing and Aerospace 
probabilistic analysis codes, which were independently-developed, should be verified. One 
approach to achieving this verification is to compare the analysis results from the two codes 
for at least one debris case 
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Appendix A. Shuttle System Improvements to Reduce the Debris 

Environment 

A.l Forward Bipod Thermal Protection System Redesign 

1 . New baseline design change eliminates the bipod foam ramp. 

a) Structural verification tests have confirmed the performance of the modified 
fitting in defined flight environments. 

b) Wind tunnel testing has verified the TPS closeout performance when exposed to 
ascent aerodynamic and thermal environments. 

2. Bipod fittings incorporate redundant heaters in the base of the bipod to prevent ice 

formation as a debris hazard. 

a) Thermal verification tests with the automated heater control performance 
validated based on bipod web temperature measurements. 

3. Redesigned closeout application process to reduce complexity. Enhanced spray 

techniques and implemented additional process controls to reduce variability. 

A.2 Liquid Oxygen (LO 2 ) Feedline Bellows Ice Elimination/Reduction Efforts 

1 . TPS “drip lip” option to address ice formation on the LO 2 feedline bellows. 

a) Drip lip diverts condensate from the bellows and significantly reduces ice 
formation by as much as 60 percent. 

b) Drip lip design is complete. Installation of additional foam to form the drip lip 
was installed before ET-120 and ET-121. 

2. To further reduce ice formation, heater installed in forward bellows location. 

A.3 Protuberance Air Load (PAL) Ramp 

1 . ET PAL ramps design assessment. 

a) Ramp foam loss in the history of the Shuttle on STS-4 and STS-7. 

b) Related to cryopumping of air into associated panels and pre-launch repairs. 

c) Subsequent changes in configuration and repair criteria reduced the potential for 
foam loss from this area. No further foam loss is believed to have occurred. 

d) Due to the size and location of the PAL ramps, placed them at the top of the 
priority list for TPS verification reassessment and NDE. 
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e) Verification data for the existing ramps were reassessed and determined to be 
valid. 

2. Dissected similar hardware from ET-94 and conducted perfonnance demonstration tests. 

3. A 10-foot section of the LH 2 PAL ramp in the area of the LFE/intertank flange was 
removed and replaced with improved foam application techniques and process controls. 

4. NDE techniques are being used to gather engineering data following the foam 
application. 

A.4 LH 2 /Intertank Flange Closeout Redesign 

RTF efforts to reduce potential for foam loss at the Lffi/intcrtank flange include: 

1 . Removing and replacing the LFF/intertank flange foam in the critical debris zone. 

2. Reversing the flange bolt installation to reduce the potential for voids created around the 
fastener as the closeout foam is applied. 

3. Injection of foam into the stringer cavity minimizing voids over the flange nuts. 

4. Point filling voids in the substrate at the intertank splice panels. 

5. Reducing liquid nitrogen (LN 2 ) migration through the flange bolts by applying a barrier. 

6. Reducing the complexity of the closeout foam spray by employing a four-step foam 
application process: stringer injection closeout; thrust panel rib pocket closeout; upper 
flange closeout; and lower flange closeout. 

7. Removing and replacing the forward 10-foot section of the LH 2 PAL ramp using 
improved application techniques. 

A.5 Solid Rocket Booster (SRB) Bolt Catcher Redesign 

The bolt catcher assembly and related hardware was redesigned and qualified by testing as a 

complete system to demonstrate compliance with FOS requirements. 

1 . Redesign of the bolt catcher housing is fabricated from a single piece of aluminum 
forging that removes the weld, which was the weakest element, from the original design. 

2. New energy-absorbing material and thermal protection selected. 

3. Redesign and resizing of the ET attachment bolts and inserts. 

4. Testing to characterize the energy absorber material. 

5. Testing to determine the design loads. 

6. Qualification tests demonstrated that the assembly complies with the FOS of 1.4. 
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7. Cork selected as the TPS material for the bolt catcher. 

A.6 Other Debris Sources 

1 . Replaced the Orbiter Reaction Control System (RCS) thruster cover “butcher paper” with 
material that sheds at low velocity. 

2. Cleaned up the pad area to reduce debris during lift-off. 

A.7 Improvements to the Orbiter RCC 

NDE: Improved NDE capabilities provide greater knowledge of the integrity of the Orbiter 
RCC parts prior to launch. The features of the NDE capability are: 

1 . The following systems are currently certified: X-ray, ultrasound (wet and dry), Eddy 
current, and computer-aided tomography scan. 

2. Only Eddy current can be conducted without removing components from the vehicle. 

3. Eddy current testing is useful for assessing the health of the RCC outer coating and 
detecting possible localized subsurface oxidation and mass loss. It reveals little about a 
component’s internal structure. 

4. All RCC components from the vehicles were removed and returned to the vendor facility 
for comprehensive NDE. 

a) Structural integrity and an estimate of mass loss were validated by off-vehicle 
NDE and destructive testing of flown RCC WLE components. 

b) The health of the associated attach hardware was also detennined using a 
combination of visual inspection and NDE methods appropriate to identify critical 
size flaws inherent to the components. 


WLE Sensor System: An impact warning system has been implemented on the WLE on STS- 

1 14. (It should be noted that the system that will fly on STS- 1 14 is a developmental system). 

The system has the following features: 

1 . Accelerometer-based sensors on the WLE spar as an additional means to identify impact. 

2. Includes 132 accelerometer measurements that will be acquired by 44 3-channel, 
high-rate, battery-powered data acquisition units located in the wing compartments. 

3. Raw data will be post-processed within each acquisition unit to detennine applicable 
windows of data that will be transmitted via radio frequency to relay units also located in 
the wing cavity. 
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4. Data will be relayed via RS-485 serial bus and radio frequency transmission to a laptop- 
based receiver unit in the crew cabin where the data will be stored in files. 

5. Files are then routed through the Orbiter Communications Adapter and the Ku-band 
system to ground personnel for evaluation. 

6. In the event that an impact is detected, engineers can determine the location of the 
sensor(s) that measured the impact and recommend a more focused inspection of the area 
later in the mission. 


A.8 Orbiter Hardening 

Phase I: Front spar “sneak flow” protection for the most vulnerable and critical WLE 

Panels 5 through 13. (Implemented for STS-1 14). 

Phase II: “Sneak flow” front spar protection for the remaining RCC Panels 1 through 4 and 

Panels 14 through 22. (Project is in the final design phase. Implementation of the 
Phase II modifications may begin as early as one year after RTF). 

Phase III: Replace WLE Panels with more robust RCC Panels. (This is a less mature option, 

but holds promise for increasing the robustness of the Orbiter). 
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Appendix B. List of Definitions 

The definitions provided below are those developed by the SSP and documented in a Return to 
Flight (RTF) White Paper entitled, “Return to Flight Rationale for Expected Debris 
Environments”, written by B. H. Wendler, March 2005. 

Debris Mass: 

1) If larger than what the impact resistance indicates for a no-configuration change condition, 
then affects the thermal protection integrity; 

2) Flas a mass larger than what the impact tolerance allows and a probability of occurrence that 
is not controlled to an acceptable hazard level; 

3) Does not have substantiating engineering proof or NSTS 07700 exemption to show that the 
mass will not exceed impact tolerance on vehicle surface structure. 

The first case can be quantified by a margin calculation C/E. The second case requires 
probabilistic predictions. 

Minimum Impact Tolerance (WOW): Based on assuming all input values that determine the 
impact tolerance capability has a no risk assumption. This means each input into the uncertainty 
branch has negligible uncertainty by taking an even more conservative value. FOS, “A” basis 
properties, worst case re-entry, end-of-life conditions, etc., are assumed at the worst case level. 
The full uncertainty considerations were to be enveloped and allowed to accumulate through the 
chain of engineering. 

Maximum Predicted Mass (MPM): Three types of MPM debris exist. 

1) Maximum certified levels of debris (e.g. allowable level of foam divot mass from ET 
ice/frost ramp in LO 2 tanks area); 

2) Historical accepted mass levels are noted as the maximum observed mass; or 

3) Design mass (1.4.5). 

The second case involves items that did not undergo design certification review with uncertainty 
predictions or other predictive analysis. For example, ablation products, string, or other non- 
propulsive objects less than 0.00021b ra , where no debris transport, liberation model, or impact 
tolerance are known. 

“Best Estimated” Mass: Maximum liberated debris size where it would be unlikely to be 
exceeded or experienced. The basis of this estimate consists of engineering analysis and test 
results that show adequate conservatism exists in the combined values assumed. Conservatism 
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relies on combining the uncertainties in an end-to-end approach. For example, the chain of 
engineering used to predict the mass liberated involved a greater than 2-sigma (conservative 
side) input on each value where 3 or 4 terms are combined as part of a much larger sequence of 
additional such combinations or WOW combinations. Some of the terms combined may not have 
distributed properties, but the predicted inputs have been “enveloped” over pass/fail test 
conditions. 

These assumptions were anchored in either test data or more detailed simulation analysis results 
so that the uncertainties are bounded and a balanced input level that has conservatism could be 
established. If the impact site has a mass effect or other phenomena than just mass, the 
maximum estimated mass may reflect knowledge of the impact prediction conditions that include 
conservative estimates in impact angle, momentum transfers, or other terms in the capability 
over environment calculation. 

Design Mass Limit: A maximum predicted mass level derived from engineering estimates of the 
mass the design could allow. It takes into consideration redesign, process changes, geometry 
constraint on size, testing on maximum density, or other key terms used to estimate the 
maximum mass. 

Historical Mass Limit: A mass level derived from flight history kn own to shed with no special 
engineering disposition made prior to the Space Transportation System (STS)- 107, but had 
design changes as part of RTF. These are listed to help show the level of improvements made 
during the RTF effort. 

Capability over Environment (C/E): Capability is defined as the impact tolerance threshold 
that can be consistently expressed against a class of debris in a range of transport conditions. For 
example, RCC WLE material has a different capability expression for foam than for ice. It also 
is defined in engineering terms relative to the debris transport relative to the vehicle’s state 
vector predicted conditions. Again, for RCC this is usually in terms of energy; however, for tile, 
it is expressed in terms of velocity. Because of this, certain environment conditions have to be 
included in the capability model to represent a worst-case condition, like angle of impact for 
RCC. The energy term stated for each wing panel includes knowledge of the worst-case angle 
impact. Environment is defined at the physical impact site initial conditions, typically relative 
velocity and local impact angle, and inertia plus any angular momentum terms if relevant. C/E 
ratio estimates with the common engineering term become dimensionless. Terms and 
assumptions for C/E are discussed in Section 3.0. 

Impact Tolerance: The ability of the impact site to withstand an impact, without change to 
capability or configuration. The impact tolerance is typically dependant on the physical 
properties of the impact site, but also of the debris (i.e., ice will have a different impact tolerance 
than foam due to density, strength, and elastic/fracture properties). 
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Damage Tolerance: The ability to complete a mission even though the configuration, or 
capability of the design, has been altered by a debris impact. 

Flight Rationale: Closure justification that satisfies acceptance of exception to what is required. 
In this case, it is a debris environment that has basis for risk acceptance or end-to-end 
acceptance. 


NESC Request No. 05-010-E 


@ 

NASA Engineering and Safety Center 
(NESC) Technical Assessment Report 

Document #: 

RP-05-82 

Version: 

1.0 

Title: 

NESC Peer-Review of the Flight Rationale for Expected 

Debris Report 

Page #: 

88 of 148 


Appendix C. Peer-Review of Math Model Tools 

A combination of new and existing Math Model Tools have been developed to determine the 
impact tolerance and damage tolerance of the Orbiter TPS (tile and RCC) due to impacts from 
debris (primarily ice and foam from the ET). These Math Model Tools include damage 
prediction and stress analysis, aeroheating analysis, and thermal analysis. Some tools are 
physics-based and other tools are empirically-derived. But even the physics-based tools include 
empirical-based models, such as the damage model in the LS-DYNA® code. Each tool was 
created for a specific use and timeframe, including certification, real-time pre-launch 
assessments, and real-time on-orbit assessments (see Table C-l). In addition, the tools are used 
together in an integrated strategy for assessing impact damage to tile (see Figure C-l) and RCC 
(see Figure C-2). 

The NESC conducted a peer-review of the engineering data package for each Math Model Tool. 
The peer-review also included the end-to-end integrated strategy for using the tools to assess 
impact damage. The end-to-end review addressed issues related to the data transfer between 
each tool and the propagation of uncertainties from the initial definitions of the impact event to 
the predictions of damage. The following content was provided in each engineering data 
package: 

• Key Assumptions: Test and analysis results supporting the assumptions. 

• Limitations: Test and analysis results demonstrating the rationale for the limit. 

• V&V: Complete set of V&V results (tests and analyses) mapped to specific 

requirements. 

• Desktop user instructions: 

- Description 

- Assumptions and Limitations 

- Detailed description of model input and output 

- Instructions for running the tool 

- Quality checks that ensure the results are valid 

The objective of the peer-review was to determine if the tools and the end-to-end strategy are 
suitable to support STS-1 14. It should be noted that the NESC peer-review was not an 
independent software V&V. These tools are not part of the mission in-line decision-making 
process. Rather, the tools will be used by experienced, subject matter experts who will interpret 
the results and provide engineering analyses to the Mission Management Team. The results of 
the engineering readiness peer-review are summarized in the following sections. 


NESC Request No. 05-010-E 


@ 

NASA Engineering and Safety Center 
(NESC) Technical Assessment Report 

Document #: 

RP-05-82 

Version: 

1.0 

Title: 

NESC Peer-Review of the Flight Rationale for Expected 

Debris Report 

Page #: 

89 of 148 


Table C-1. RCC and Tile Math Model Tools 



Models 

New/Updated 

Used for Pre- 

Used Real-Time 



/Existing 

Flight C/E 

Launch 

On-Orbit 

On-Orbit 





Go/No- 

before 

Use-as-is 





Go 

Inspection 


RCC Damage Prediction Tools 







RCC DYNA Model 

N 

X 


X 



RCC Rapid Response Damage Model 

N 


X 

X 


RCC Aeroheating Tools 







Step/Ramp Heating 

N 






WLE Breach Internal Flow Model 

N 




X 


RCC Damage Growth Tool 

N 




X 

RCC Thermal Models 






RCC 3-D Thermal Math Models 

E 




X 

Tile Damage Prediction Tools 







Tile Rapid Response Damage Model (foam) 

N 

X 

X 

X 



Tile Rapid Response Damage Model (ice) 

N 

X 

X 

X 


Tile Aeroheating Tools 







Cavity Heating Database 

N 

X 



X 


CFD for Cavity Heating 

N 

X 



X 


Catalytic Heating Tool 

N 

X 



X 


Boundary Layer Transition Prediction Tool 

N 

X 



X 

Tile Thermal Tools 







3-D Acreage Tile Thermal Model 

N 

X 



X 


Repaired Tile Thermal Model 

N 






Special Configuration Thermal Models 

N 




X 

Tile Stress Tools 







Tile Stress Tool 

N 

X 



X 


Tile Bondline Integrity Tool 

U 

X 



X 


Stress Assessor Tool 

N 

X 
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Figure C-l. Tile Tools for Pre-Flight and On-Orbit Damage Analysis 
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Figure C-2. RCC Models for Pre-Flight and On-Orbit Damage Analysis 
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C.l RCC DYNA MODEL 

This tool review involves the review of the application of LS-DYNA© software to impact of 
foam and ice on RCC and is not a review of the LS-DYNA© software. 

C.1.1 Function(s) of Tool 

Finite element simulations using LS-DYNA© code provide analysis results based on 
empirically-derived material data input definitions that qualitatively correlate with observed 
foam-impact test behavior of WLE RCC panels. LS-DYNA© correlations are done with flat 
panel and panel (9L) tests. Flat panel maximum deflections correlate to within 15 percent up to 
the onset of damage. Damage maps using the “l-to-5 elements out” criterion correlate 
qualitatively well with test data, as does test correlation of the “onset of NDE detectable 
damage”. Test results clearly identify the RCC impact threat due to debris, which had not been 
kn own previously. Testing is perfonned on specific panels (flat and full panels) and at several 
locations on these panels. The LS-DYNA© finite element models and analyses were validated 
using these test results. LS-DYNA© is then used to analyze other panels and for impact at other 
panel locations to evaluate the capability of the panels against foam and ice debris impact in lieu 
of full-scale testing of all WLE RCC panels. These results are then used to establish the 
capability, or “C”, of the RCC panels for the flight rationale in terms of threshold KE. 

C.1.2 Assumptions and Limitations 

1 . Delamination is a mode of damage that is observed in the RCC WLE panels due to 
impact loads. However, delamination is not modeled in the LS-DYNA© analysis. As 
such, the current model is incapable of predicting delamination. 

2. The Program’s LS-DYNA© analysis uses shell elements. The surface coatings are not 
explicitly modeled. The SiC outer layers and the CC substrate are modeled using 
smeared materials properties. As such, the current model is incapable of directly 
predicting coating loss. 

3. LS-DYNA© can only be used to predict the “onset of NDE detectable damage” or 
threshold of damage - it cannot be used to predict damage growth because the material 
damage model used in the LS-DYNA© models does not accurately represent all forms of 
RCC damage. The approach to predicting “onset” is by scaling the LS-DYNA© 
predictions of “l-to-5 elements out” damage state. 

4. Applicability of “onset of NDE detectable damage” criterion is currently based on panel 
apex foam impacts. 

5. Analysis quality checks similar to those perfonned on the RCC WLE panels are not 
available for the nose cap and chin panel. Additionally, the LS-DYNA© finite element 
models for the nose cap and chin panel are not verified with full-scale testing. 
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0 2 

6. The small mass effect is assumed to vary by a factor (mi/rm) ' where mi is the mass of 
the debris and m 2 is a reference mass. This factor appears to be analytically arrived and 
empirically correlated with the LS-DYNA© prediction based on a range of masses. This 
factor has not been validated using test data. 

C.1.3 Observations 

1 . RCC material properties have wide scatter. The material model is based on empirical 
material model (MAT 58) with tuned parameters (SLIMT=0.8, SLIMC=1.0 and 
ERODS=0.1). These parameters do not correspond to any physical material properties 
and are not derivable from the RCC material characterization tests. 

2. Rectangular foam brick with length aligned with velocity trajectory presents the worst 
case for panel apex impact. The square block of ice, with the large face impacting 
tangent to the panel, produces the largest damage panels that are marginally more 
sensitive to ice impacts near panel ribs. 

3. The LS-DYNA© model does not correlate the displacement time histories for full-scale 
test panels. In contrast, threshold velocities for damage initiation correlate within 10 
percent with the test results on the flat and full panels. 

C.1.4 Recommendations 

1 . The scope of intended use and the associated limitations of the debris on RCC analyses 
need to be clearly documented. 

2. Engineering data to support the adjustment factor(s) used to convert from “l-to-5 
elements out” criterion to the “onset of NDE detectable damage” criterion are needed. 

3. Engineering data are needed to validate the nose cap and chin panel finite element models 
and predictions - mesh sensitivity, material orientation, etc. 

4. Engineering data are needed for comparing full-scale panel test results with LS-DYNA'' 
predictions (time -history plots of deflections and strains as well as end-state deformation 
patterns) - in particular, for Panel 9 tests that did not exhibit impact damage. 

5. The small mass factor for BX and PDL foams need to be documented. Valid bounds of 
this factor need to be established, especially as size limits are approached. 

6. RCC material characterization data including: effects of aging (or conditioning), strain- 
rate effects, failure modes and mechanisms, fracture toughness, load-unload behavior 
needs to be completed. These data will be useful in developing next generation material 
models that could be used with LS-DYNA®. 

7. Investigation of through- the-thickness material layout (rather than smeared) such as 
discrete layer modeling of SiC outer layers and CC substrate needs to be undertaken. 
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8. The effect of multiple strikes at the same (or nearly the same) location and KE levels 

(G) 

using the LS-DYNA tool needs to be quantified. 
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C.2 RCC RAPID RESPONSE DAMAGE MODEL 
C.2.1 Function(s) of Tool 

The intended use of IMPACT2 for pre-flight and on-orbit is to provide insight beyond the LS- 
DYNA'"' production run matrix with sensitivity analyses to small variations in location and 
impact angle. For pre-flight, IMPACT2 use would be to assess last minute concerns 
immediately prior to launch. For on-orbit, IMPACT2 use would be to assess panel damage due 
to reported debris strike(s) and document critical locations for subsequent LS-DYNA analyses. 
Finite element simulations based on the IMPACT2 code are used to estimate the effect of debris 
impact on RCC WLE panels. The finite element models are currently based on the historical 
NASTRAN models (“certified” models) for the generation of free-vibration mode shapes. These 
mode shapes are used to perform a modal analysis with the forcing function defined to simulate 
the debris impact loading (i.e., nonlinear forcing function). 

C.2.2 Limitations 

1 . Application of this modeling and analysis approach for cases without LS-DYNA" 
collaboration introduces uncertainties that do not have clear bounds. 

2. Point or concentrated force application is an approximation of the impact event (may not 
accurately simulate the true contact problem, but should be conservative). 

3. Application of IMPACT2 is limited to RCC WLE panels; applications to the nose cap 
and chin panel have not been demonstrated. 

C.2.3 Observations 

1 . Foam model uses modal dynamics analysis with concentrated nonlinear force input. 

Foam impact force determined via coupled system analysis (force is a function of foam- 
panel relative displacement). Projectile is assumed to be prismatic and does not breakup. 

2. Ice model uses linear modal dynamics analysis with fluid jet concentrated impact force. 
Ice is assumed to be “prismatic”. Ice impact force is determined from fluid jet impulse 
and is applied as a triangular-shaped time pulse. 

3. The IMPACT2 predicted threshold values of velocity are within 6 percent for hard ice 
and 1 1 percent for BX-265 foam compared with Panel 9 testing. Comparing to LS- 
DYNA" predictions, the IMPACT2 predicted threshold velocities are within 15 percent 
and 20 percent for foam and ice impacts, respectively (excluding Panels 4 and 7). 
However, LS-DYNA " predictions themselves are within 15-19 percent of the test data. 
Therefore, uncertainties in IMPACT2 predictions could exceed 30 percent on threshold 
velocities of the test data. 
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4. Linear modal solution accuracy may be appropriate for onset predictions - assuming 
small deflections, lightly loaded panel. Point or concentrated force application is an 
approximation of the impact event (may not accurately simulate the true contact problem, 
but should be conservative). Convergence of the modal solution is demonstrated. If the 
convergence is based on the convergence to the value obtained from the complete finite 
element model and a direct time integration procedure, then the 800-mode solution 
converges to the complete-model solution. The question that remains is whether the 
complete-model solution is itself a converged solution for this type of simulation. 

C.2.4 Recommendations 

1 . Demonstrate the rapid response of IMPACT2 using 6” x 6” and 6” x 12” flat panels. 

2. Validate IMPACT2 with 6” x 6” and 6” x 12” flat panel test data. 

3. Demonstrate the rapid response tool application for the nose cap and chin panel 
structures. 

4. Provide a complete data pack of ah analyses, data, and results for archival purposes and 
traceability. 
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C.3 RCC DAMAGE GROWTH TOOL 
C.3.1 Function(s) of Tool 

The RCC Damage Growth Tool will be used to predict damage growth at impact damage sites, 
including time -to bum-through (breach) and hole growth, during entry and to develop the impact 
damage tolerance map for WLE and nose cap RCC. 

C.3. 2 Assumptions and Limitations 

1. Input Parameters: 

a. Delamination Extent - The tool has limited capability for predicting an equivalent 
IML hole diameter pending development of on-orbit validated NDE techniques to 
determine the extent of delamination. 

b. Mid-plane Delamination - Uncertainty in the predicted cavity burn-through time 
exists due to the limited number of arcjet samples from full-scale impact damaged 
RCC panels. 

2. Model Physics: 

a. Mass Loss Expression - The tool, in its current state of development, acts as a 
conservative bounding estimation for predicting time to breach and damage 
growth. Higher fidelity solutions are needed to avoid unwarranted conservatism 
in the prediction of material removal. 

3 . V erification and V alidation (V &V): 

a. Arcjet Testing - The current tool is validated as conservative only for stagnation 
flow cases similar to the nose cap environment. Pending development of a 
wedge/crossflow tool, the stagnation tool has not been adequately validated as 
conservative for application to WLE environments that experience crossflow. 
Wedge test data for machined defects may indicate that the 0.020-inch substrate 
exposure threshold is unconservative at maximum heating, and that growth rates 
are larger than expected for stagnation cases. Given the small amount of available 
wedge data, the NESC is currently unable to conclude that machined-slot hole 
growth is atypical of impact-induced Types 4 or 5 damage. 

b. Conservatisms - Although the stagnation tool appears biased toward conservative 
predictions, the safety margin decreases with increasing temperature. Because 
validation data is limited, an unskilled user may infer unwarranted confidence in 
tool predictions of untested configurations. Given the inherent uncertainties of 
certain tool inputs and assumptions, the tool requires use and interpretation only 
by subject matter experts. 
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C.3.3 Observations 

1. Input Parameters: 

a. Delamination Extent - The assumption that the delamination extends 1-inch 
beyond the perimeter of any observed OML damage on an RCC panel may not 
adequately represent the extent of delamination. This observation is of concern 
because this assumption directly impacts the accuracy of the tool output 
“Equivalent IML Hole Diameter”. 

In the V&V of the RCC Damage Growth Tool, the extent of de lamination for 
arcjet samples was determined by ultrasonic through transmission and infrared 
thennography. The validation of the tool relies on the accuracy of ultrasonic and 
thennographic NDE techniques to accurately identify the extent of delamination. 
This accuracy has not been demonstrated due to limited data for extent of 
delamination of full-scale impact-damaged RCC panels as determined by NDE. 
Furthermore, the current capability for on-orbit NDE does not exist, and the 
predictive capability of the tool relies on the 1-inch assumption. 

Since on-orbit NDE is not currently available, delamination size will be estimated 
based on the 1-inch assumption. The tool developers acknowledge that this 
uncertainty will overshadow any uncertainty in other tool parameters. 

b. Mid-plane Delamination - The assumption that the worst case impact damage 
results in a single mid-plane delamination is reasonable based on the available 
evidence. Additional validation is needed to demonstrate that this assumption is 
conservative. This validation should be based on a comparison of tool predictions 
to time-to-burn-through determined for arcjet tests of full-scale impact damaged 
RCC panels. Without additional validation, this assumption introduces a measure 
of uncertainty into the predicted cavity burn-through time. If burn-through is 
already predicted by the current version of the tool, then this observation is 
irrelevant. However, if damage occurs in an area of the WLE that is predicted to 
survive re-entry with the current tool and the output “Cavity Burn-Thru Time 
(sec)” is required, then the validity of this assumption is critical. 

3. Model Physics: 

a. Mass Loss Expression - The damage growth tool is empirically-based and does 

not capture the physics of an ablating material. The mass loss expression does not 
adequately couple the flow field and material physics to allow its use outside the 
range of test conditions for which it was developed. The Arrhenius expression 
used to predict material ablation does not account for the effect of mass transfer 
rate which is one of the primary driving parameters that causes material removal. 
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Instead, the tool simply uses pressure and temperature to determine the material 
recession rates. It appears that the recession correlations are based on test 
conditions that are conservative relative to flight 1 and, therefore, the tool is 
expected to yield conservative predictions for time to breach and damage growth. 
The level of conservatism is not readily ascertained because the primary variables 
that produce material recession are not specifically included in the calculations. It 
is important that the tool use the primary variables that effect material removal so 
that a more accurate surface recession prediction can be obtained. This approach 
would also allow for a more refined predictive tool that could be used for a 
sensitivity analysis. 

4. Verification and Validation (V&V): 

a. Arcjet Testing - Based on stagnation testing of impact-damaged RCC panel, the 
0.020” criterion for allowable coating damage or crack width appears valid. For 
more extensive damage, the stagnation tool appears to conservatively predict both 
the onset of damage growth and the ultimate IML damage area for stagnation 
arcjet cases. The tool designers claim that the stagnation tool conservatively 
predicts both the onset of damage growth and ultimate IML breach area for wedge 
test cases. However, this claim is not supported by the data supplied to the review 
panel. In fact, data for machined-slots in wedge specimens contradicts the 
conservatism claim. 

b. Conservatisms - The test series focused on development of conservative 
prediction capability rather than tool validation. As a result, the low repeatability 
of specimen preparation and test conditions hinders systematic evaluation of tool 
sensitivity to test parameters. The predictive conservatism of the (stagnation) tool 
varies with application to stagnation, or wedge cases and mode of induced 
damage. Also, the single cited comparison of equivalent stagnation (Run 2-2621- 
4, Model 1965) and wedge (Run 2-2651-4, Model 2035) cases is inadequate to 
establish the conservatism of either testing mode. The tool output does not 
indicate the confidence or conservatism with which its predictions should be 
evaluated. 


1 The statement of conservatism is based on a verbal description of a high fidelity finite element analysis, including cavity 
radiation that has been conducted to establish that surface temperatures of 2960 °F at BP 5505 are consistent with peak flight 
heating conditions of approximately 70 BTU/ft2-sec for flight. 
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C.3.4 Recommendations 

1. Input Parameters: 

a. Delamination Extent - Validated on-orbit NDE techniques should be developed 
for determining the extent of delamination. For STS-1 14, the current tool should 
only be used by an experienced subject matter expert, such as the tool developers, 
to predict hole growth. 

b. Mid-plane Delamination - Additional time to burn- through data should be 
obtained from arcjet tests of full-scale impact damaged RCC panels to determine 
whether the predicted burn-through times are conservative. 

2. Model Physics: 

a. Mass Loss Expression - Future versions of the code should be more physics based 
and use the convective boundary conditions as the driving parameters which 
determine surface removal rates. Even if empirical expressions are selected, mass 
transfer rate should be used as a primary variable that determines material 
removal rates. This will result in a higher fidelity tool that more accurately 
predicts time to breach and damage growth. 

3 . V erification and V alidation (V &V): 

a. Arcjet Testing - Impact-damaged wedge test data is urgently required for 
development and validation of a maximum damage criterion and a 
wedge/crossflow damage tool. Pending development and validation of a 
wedge/crossflow tool, the stagnation tool should be used to “predict” the results 
of existing wedge testing. This would indicate the sensitivity of the stagnation 
tool to deviations from stagnation flow, and establish the conservatism of the 
allowable damage criterion in non-stagnation environments. 

In addition, because achieving flight temperatures required testing at different 
heat fluxes for stagnation and wedge (and at heat fluxes far greater than those 
estimated for flight), there may be significant differences in the flow 
environments of both the stagnation and wedge configurations. Better 
understanding and quantification of these losses, and consideration of improved 
test configuration, is recommended. 

b. Conservatisms - More test data, for both stagnation and wedge cases, is required 
to test the sensitivity of tool conservatism to damage parameters. Additionally, 
the tool should be exercised to assess the sensitivity of tool predictions to likely 
uncertainties in the tool’s assumptions. Those uncertainties include variations in 
damage locations, trajectory profiles, and the effects of multiple delaminations. 
The results of this analysis should be bundled into the tool documentation. 
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C.4 TILE RAPID RESPONSE DAMAGE MODEL (ICE) 

C.4.1 Function(s) of Tool 

“Rapid Response” damage models for both foam and ice debris damage on tile have been 
developed for the Space Shuttle Program. These models generate a damage geometry (depth, 
length, width, entry, wall and exit angles) based on debris transport analysis parameters (mass, 
velocity and angle of impact). The ice on tile model was developed by Southwest Research 
Institute (SwRI), with Dr. James Walker as the lead of the development team. The specific 
intended application is to evaluate the damage to both FRCI-12 and LI-900 tile from projectiles 
composed of ice of all densities possible in the environment. It has been baselined for use in 
pre-flight and in-flight analysis by the Orbiter SLD panel. The estimate of the results is generated 
using 2-D analytical closed-form equations derived from the basic physics of the problem. These 
were validated by comparison with test and large scale numerical solutions using the Eulerian 
code CTH. As with other analytical solutions to complex engineering problems, such as the 
Navier-Stokes Equation, simplifying assumptions are required to produce a tractable solution. 

The degree to which these assumptions are valid defines the usefulness of this analytical 
solution. 

The model, as developed, uses nominal material values and other input parameters. Therefore, it 
would not be expected to envelope all of the test data, which captures all the variability in the 
parameters. To obtain a model that would be conservative without being excessively over- 
conservative, SwRI was directed to generate a model that would encompass 95 percent of the test 
data. This percentage level was deemed appropriate by NASA management compared with a 
traditional 3-sigma level of 99.86 percent in that other conservatisms were also built-in to the 
end-to-end debris liberation, transport, and impact scenario. A worst-on- worst-on-worst case 
calculation would result in unreasonable restrictions on tile capability. As the material properties 
are the primary source of uncertainty, SwRI decided that a reasonable way to achieve this goal 
was to apply a constant scale factor onto the material properties used in the nominal model. The 
value obtained after iteration was 0.615, and it was used to generate results and curves for this 
“95%” model. This scale factor is in the same range as the spread of the strength characteristics 
of the tile by itself. These results along with the nominal model results have been documented 
and reported by SwRI. 

C.4.2 Assumptions and Limitations 

Key Assumptions : 

1 . Cavity width is assumed to be twice the impactor width; the actual value is not 

calculated. [The width was not systematically examined in either the analytical model or 
with CTH. Typically, the width is not as large as this factor. Data is presented to back 
up this assumption, but it is exceeded somewhat, occasionally by 100 percent.] 
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2. Assumes brick-shaped impactor. 

3. Entry angle is equivalent to impactor incident angle. [The foam on tile model does not 
make this assumption. The validation of this assumption has not been presented.] 

4. Sidewall angles and exit angles are assumed to be 90°. 

5. The model assumes the projectile impacts the target and never unloads (no rebound). 
[This could potentially be unconservative, as the rebound gives more load transfer to the 
target (momentum transfer). By contrast, CTH does include unloading.] 

6. The projectile is not rotating. [Studies performed for foam on tile indicate that the 
possible rotational rates do not add significantly to the local impact velocity of 
ends of the projectile at these translational speeds.] 

7. The impactor is assumed to have a curved lower leading edge of radius 0.25 cm to 
take into consideration ice fracture effects. This factor was empirically-derived. 

8. The glass layer of the tile is assumed to not provide noticeably more strength. 

The material characteristics used for ice are as follows: 

Modulus of Elasticity (E) = 8000 MPa 
Shear Modulus (G) = 3000 MPa 
Density = 0.914 g/cc (57 lb/ft3) 

Poisson’s ratio = 0.33 
Flow stress = 2.0 MPa 
Tensile strength =1.0 MPa 
Sound speed (c) = 2954 m/s 

High strain compression curves were obtained from tests used for both types of tile. 

Limitations: 

1. Projectile mass range: 0 to 1 pound (453 g) 

2. Impact velocity: 80 to 1500 ft/s 

3. Impact angle: 5° to 90° 

4. Maximum validated predicted cavity depth: 3” 

5. In the region of 60° to 90°, the model is only valid for L/D >2.5, where D is the 
average of the width and height. [The testing does not cover the ranges that are 
suggested above, but CTH was performed over those ranges. The largest mass 
tested was 100 grams (3” x 1.5” x 1.5”), and the highest velocity tested was 1000 
ft/sec. SwRI has proposed the extension of the limits because CTH was performed 
up to these ranges. Although the analytical model predicts a much larger amount 
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of damage than CTH at large velocities, it is reasonably validated. The CTH high 
velocity/high mass runs can be used to reliably identify any gross possible 
underpredictions, which it did not do.] 

C.4.3 Observations 

1 . The ice on tile rapid response model is reliably conservative for all variations of the input 
parameters. There is a significant amount of validation by both experimental data and 
CTH numerical simulation. It appears in general to overpredict the damage by a 
significant amount in almost all cases. Since this is the case, the only assumption that 
could cause an underprediction by the analytical model (number 5) apparently is not 
significant. 

2. There is a lot of scatter in the test data for ice impact on tile. In many cases there is 0.50- 
inch of penetration depth scatter for any given set of conditions, 0.75-inch scatter on 
depth is not that unusual and for a few cases there is almost 1-inch of scatter on depth of 
penetration. 

3. The model is detenninistic so uncertainties arising from variability in input data, such as 
material data for the tile and impact parameters (size and density of ice, impact speed and 
angle), are unaccounted for. 

4. Eulerian models such as CTH do not have a capability to incorporate friction, which can 
be important for angled impacts. 

5. The model does not predict the physics of “tile out” or “tile shear out”. “Tile out” is a 
failure mode where the impacted tile fails at the densification layer with little surface 
damage, and the entire tile comes out down to the densification layer. “Tile shear out” is 
a failure mode where the impacted tile fails at a weak shear plane (45 degrees from 
surface to densification layer) and a large portion of the tile comes out down to the 
densification layer. 

6. The model is only applicable to a predicted depth of penetration less than or equal to the 
densification layer. Once the impact is predicted to be into the densification layer, the 
physics changes and the model is no longer valid. 

C.4.4 Recommendations 

1. Tile damage analysis models should be brought in-house to NASA to enable additional 
evaluation and independent tile damage risk trades through structured, parametric model 
sensitivity studies. 

2. An effort should be made to quantify how much the uncertainties from the input are 
propagated into the results. Sensitivity or response surface analysis could be a method to 
make this determination. 
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3. There are some significant exceedances of the 2-to-l crater width to projectile width 
factor in the high-density ice on LI-900 tile. A more complete explanation of why this is 
not important may be necessary. 

4. Present rationale for entry angle equaling impact angle (and contrast with foam-on- tile 
model rationale for assuming otherwise). 

5. Provide evidence of solution verification, i.e., “ The process of determining that a model 
implementation accurately represents the developer ’s conceptual description and 
specifications - deals with mathematics and numerics; provides evidence that the model is 
solved correctly.” 1 It is critical that the analytical model be quantitatively debugged by 
running the solution on simplified materials and/or short time frames that can be checked 
independently (outside of the solution code itself). 

6. Evaluate Lagrangian finite element solution of angled-impact problem, such as that 
applied with LS-DYNA C0 , to assess effects that may have been missed by lack of a 
frictional coefficient. 

7. Provide evidence for assumption number 8 (glass tile layer not providing more strength). 

8. The decrease in the slope of the depth versus velocity curves for the CTH results for 
higher velocities (at all angles) should be examined in further detail. If this effect is 
accurate, then the analytical model predictions at these higher velocities are excessively 
conservative, which can lead to undesirable decisions. 


1 Oberkampf, W„ Roy, C., “Verification and Validation in Computational Simulations”, AIAA Short Course, April 16-17, 2005 
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C.5 CAVITY HEATING TOOL 
C.5.1 Function(s) of Tool 

Space Shuttle Orbiter damaged tile regions must be analyzed by aeroheating, thermal, and stress 
groups to determine the effect of damage on safe re-entry. These damaged tile regions can cause 
a change in the nominal Orbiter surface heating profile. Heating profiles in the damage region 
are modeled by assigning a baseline (“undisturbed”) heating value near the damage and applying 
an augmentation factor to the nominal heating value for the affected regions in or near the 
damage. The Cavity Heating Tool (CHT) is used to determine the aeroheating augmentation 
factors needed to support the thermal analysis of damaged tile regions. 

The CHT uses wind tunnel test-measured heating augmentation factors to expand the historical 
2-D turbulent engineering database to include fully laminar 3-D augmentation factors. In 
addition, the CHT provides 3-D turbulent augmentation factors and automated boundary layer 
property prediction capability to determine the properties needed for augmentation factor 
prediction. Historically, a 2-D turbulent cavity heating augmentation factor database has been 
used to support TPS damage analysis. This historical database is generally believed to be 
conservative, especially for the laminar portion of the entry trajectory. To reduce unnecessary 
conservatism, the CHT was developed to provide the OPO with more realistic augmentation 
factors in the laminar flow regime. 

The CHT is capable of providing laminar and turbulent cavity heating augmentation factors for 
the Orbiter windward surface throughout a given trajectory. Laminar augmentation factors are 
derived from data obtained during recent wind tunnel testing perfonned at NASA Langley 
Research Center. Turbulent augmentation factors have been derived from the Reference 
Aeroheating Methodology. The following enhanced capabilities of the CHT reduce the 
unnecessary conservatism and increase the fidelity of this historical method. 

1 . Provides time-dependent augmentation factors instead of applying a single conservative 
(Mach 18) value throughout trajectory. 

2. Expands the turbulent cavity heating augmentation factor database to include laminar 
factors (laminar factors are generally lower and apply over a significant portion of the re- 
entry trajectory). 

3. Applies more realistic heating distributions outside the cavity (non-linear vs. linear) 
based on wind tunnel test results. 

4. Full integration into the 3-D TMM allows for reduced analysis time requirements, 
providing more time for the critical decision-making process. 

5. The CHT is applicable for both pre-flight tile damage tolerance assessments and in-flight 
tile damage assessments. 
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C.5.2 Assumptions and Limitations (and Uncertainties) 

Several key assumptions were made during the development of the CHT. 

1 . Foremost is in the application of wind tunnel test derived augmentation factors as valid 
for flight conditions. The developers are conducting a flight traceability study using CFD 
analysis to show that CHT augmentation factors cover any wind tunnel-to-flight 
increment. 

2. The orientation of the damage site is assumed to be aligned with the local flow field on 
the vehicle surface, and no adjustments are made for crossflow cavities. 

3. The CHT was developed from test data on cavities aligned with the flow. Results from 
limited test data of cavities with crossflow do not, however, indicate any discemable 
trend that the distribution of augmentation factors would be altered. Note that for large 
crossflow angles > 15deg the heating becomes less severe because effective cavity length 
decreases. (Adjustments are to be included in future versions after additional testing has 
been completed.) 

4. It is assumed that an entry and exit angle of 90° is conservative and plays a minor role in 
augmentation factor predictions. This is supported by a limited available wind tunnel 
data for non-90° angles (angles of 90°, 45°, 25°, and 6° were tested). Also, the CHT was 
developed from test data on cavities with 1.0 < L/W < 12.5 ratios. Width appears to play 
a minor role, especially for wider cavities. 

5. It is assumed that the derived laminar methodologies can be applied to regions on the 
Orbiter with Mach edge numbers (Me) below values tested in the wind tunnel. This is 
supported by data which shows no discernable Me trend for average cavity floor values 
and maximum heating augmentation factors for the non-transitional cavities in the range 
tested 

A few key limitations have been noted in the development of the CHT. 

6. The tool is designed for local cavity augmentation factors - no factors further than one 
cavity length downstream are provided by the CHT. (Note that the additional downstream 
effects are addressed by the Boundary Layer Transition Prediction Tool). 

7. The updated CHT wind tunnel test results address only conditions of laminar flow over 
cavities. Turbulent flow over cavities is addressed by the historical method. 

Additionally, the automated results from the CHT are not valid for leeward surface, only 
windward surface application is appropriate. 

8. The CHT cannot be used for breach flows. 
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Uncertainty sources that contribute to the CHT overall prediction accuracy have been identified. 

9. The CHT relies on input from the CFD Smooth Baseline Tool to provide boundary layer 
property predictions. These boundary layer properties have uncertainties on the order of 
1 5 percent. The CHT is based on wind tunnel test data, which includes its own source of 
uncertainty in addition to any for extrapolation to flight conditions. Tile gap effects are 
not included and it is suggested that an uncertainty factor of 20 percent be applied to 
account for these configurations. 

10. Results for wing glove and chine regions (high pressure gradient regions) will not be 
validated before flight. For these high pressure gradient regions, a 50 percent uncertainty 
factor is applied to the augmentation factors. 

C.5.3 Observations 

1 . The NESC peer-review assessment is that the CHT can be used for STS- 114 with the 
accepted risk of recognized limitations, some significant, to the application and validity 
of the tool. 

2. The CHT peer-review did highlight several primary concerns from an end-to-end 
validation perspective. The first is in regards to Aeroheating data integration into the 
TMM. This should be reviewed and fully understood by both the CHT developers, the 
Aerothermal environments engineers, and the TMM users. This finding does not 
specifically affect the validity of the CHT, but is essential to the integrated analysis 
process and must be resolved prior to RTF. The second is the “50/50 rule” to establish 
the cavity geometry. Application of this simplification must be applied with caution as it 
affects the cavity dimensions which has a direct effect on the CHT augmentation factors 
and will be a first order effect in the TMM results. The combined engineering judgment 
from aeroheating, thermal, stress and TPS should be involved in establishing the cavity 
dimensions based on this rule. 

C.5.4 Recommendations 

The CHT peer-review highlighted eight (8) major findings and has provided specific 

recommendations to address each. Many of these findings address the recognized assumptions, 

limitations, and uncertainty factors addressed in Section C.5.2. The following recommendations 

have been developed from this peer-review regarding the CHT. 

1. Lack of Validation for Flight Conditions 

There is a concern that the wind tunnel data are being used to predict flight conditions 
without a quantification of the uncertainties inherent in the extrapolation. Specifically, 
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the wind tunnel data does not reproduce the real gas non-equilibrium chemistry and the 
ratio of boundary layer edge temperature to wall temperature that occur in flight. 

These real gas and wall temperature effects on the heating bump factors are not addressed 
in the documentation, but the effects need to be assessed. CFD solutions can and should 
be used to understand these effects. A direct comparison should be made by computing 
CFD solutions for a wind tunnel case and the corresponding flight case that the wind 
tunnel data is meant to predict. This process should be performed for a high Mach 
number case which will have the largest real gas effects, and a low Mach number case 
which will have the largest wall temperature effect. The differences between the wind 
tunnel CFD solutions and flight CFD solutions will provide an estimate of the uncertainty 
in the extrapolation process. This extrapolation will be partially addressed by the CFD 
For Cavity Heating: Flight Traceability study. 

2. Cavity Orientation Assumption in Wind Tunnel Data Base 

The new CHT is based on measurements made with the axis of the cavity aligned with 
the local flow direction. Since most cavities are the result of impact damage during 
ascent in which the flow field is significantly different than during re-entry, it is likely 
that some misalignment between the local flow direction and the axis of the damage will 
exist. Additional understanding of the effects of crossflow cavities must be pursued 
before RTF and can be accomplished with data already available. 

A series of 19 wind tunnel runs were made to investigate the effects of this misalignment. 
Some results are presented in the Cavity Heating Tool Draft Final Documentation. It is 
noted that the effect of cavity misalignment is to reduce the effective L/H which 
stabilizes the flow and reduces the resultant increase in heating level. Thus, ignoring the 
misalignment should produce conservative results, in that the computed bump factor will 
be higher than the physical value. Some quantification of this effect is necessary to 
prevent overly conservative results which could result in an unnecessary repair. (It has 
been noted that adjustments are to be included in future versions after additional testing 
has been completed.) However, the results of the 19 misaligned runs should be used to 
determine if a simple relationship between flow angle and bump factor reduction exists. 
Since the amount of data for misaligned cavities is relatively limited, incorporation of this 
relationship into the CHT is not recommended. However, this information should be 
developed to aid in the decision-making process which determines if repairs to the 
Shuttle tiles are necessary. 

3. Augmentation Factors for Non-Rectangular Cavities 

The CHT relies on correlations obtained from wind tunnel tests of rectangular cavities 

° 

with 90 entry/exit angles. Photographs of actual Shuttle tile damage indicate that these 
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cavities are typically irregular in shape with entry and exit angles that are shallower than 
90°. There is a concern that application of the CHT to these non-rectangular cavities 
typical of actual flight damage may not produce conservative results. Additional 
understanding of the effects of non-rectangular must be pursued before RTF and can be 
accomplished with data already available. 

The CFIT correlations are based on data obtained in the NASA Langley 20-inch Mach 6 
Air Tunnel for rectangular cavities of varying L/H, Re, M e , and FI/5. In addition to these 
runs, a series of runs were made which included variations in planform, cross-section 
profile, and cavity orientation relative to the local free stream flow direction. The data 
presented within the Cavity Ideating Tool Draft Final Documentation indicate that for a 
significant number of cases the Cavity Average and End Wall Peak bump factors for the 
non-rectangular cavities can exceed the bump factors for the rectangular cavities by non- 
trivial amounts. The significance of the increase in the End Wall Peak bump factor may 
not be great, since this would result in enhanced heating only to tile material at the aft end 
of the gouge. However, an increase in the Cavity Average bump factor could 
conceivably result in a significant increase in heating on the floor of the damage site, and 
thus cause excessive temperatures in the vehicle structure. 

It is recommended that these wind tunnel test results be re-evaluated to detennine: a) the 
exact nature of the boundary/shear layer in the vicinity of these cavities, and b) a 
relationship between the enhancement in bump factor and the deviation of the geometry 
from the standard rectangular cavity. It is likely that the first time this tool is used, the 
cavity will be significantly non-rectangular, and questions concerning the heating 
enhancements will have to be addressed. 

4. Laminar Wind Tunnel Test Data Base 

The new CHT is based on a series of wind tunnel tests conducted in the NASA Langley 
20-inch Mach 6 Air Tunnel for laminar flow over cavities. For conditions in which the 
flow is determined to be transitional or turbulent, based on the results of the Boundary 
Layer Transition Tool, the turbulent methodology which was developed early in the SSP 
is used. In the Cavity Heating Tool Draft Final Documentation, it states that the turbulent 
methodology is “generally conservative.” An example of a case in which the turbulent 
methodology may not be conservative is presented in which, when the test results 
indicate transition from closed cavity laminar correlations to turbulent correlations, both 
the resultant bump factor and the heating rate decrease. 

Some transitional and turbulent cavity cases were obtained in the wind tunnel tests. It is 
recommended that an investigation be conducted in which the turbulent cavity 
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methodology is applied to the transitional/turbulent wind tunnel cases to determine the 
extent to which this historical methodology is conservative. 

5. Application to Limited to Windward Side Damage 

The CHT, as developed and implemented, is not directly applicable to the evaluation of 
leeside damage. The CHT team clearly recognizes this limitation and in fact discusses 
the arguments against application of the tool to leeside damage sites. The CHT database 
has been generated based on tests at conditions applicable to wind-side flow. The bulk of 
the tool relies on an assumption of attached laminar flow, whereas the leeside, during the 
high heating phase of the mission, will typically be dominated by turbulent and/or 
separated flow. 

Having accepted these limitations, the CHT team, working with the aeroheating panel, 
formulated an approach to provide augmentation factors for leeside cavities. The concern 
is that the approach chosen will rely on several assumptions that may in fact be incorrect. 
One, the historical turbulent approach “generally assumed to be conservative” will be 
used. This assumption has yet to be validated by the cavity heating team using the data in 
hand. Two, the edge Mach number on which this turbulent formulation relies will be 
computed using CFD - based on CFD in a region considered to have relatively low 
confidence levels. These assumptions coupled with engineering judgment will be used to 
manually provide augmentation factors for the thermal analysis for damage sites on the 
leeside. 

There can be many arguments made that leeside TPS damage is unlikely to prevent a safe 
return of the vehicle. The leeside TPS is generally over designed (i.e., structural 
temperatures are maintained well within the margins) and heating levels are fairly low 
relative to the wind-side and stagnation areas. While this statement is certainly true, an 
examination of the sensitivity of the structural margins to various augmentation levels of 
the nominal heating or loss of TPS on the leeside would provide some insight. The BLT 
Tool generally assumes that transition will not wrap around to the leeside if the damage is 
outside the attachment line. There have clearly been cases shown where the transition 
can sweep across the attachment line. The concern is that possible turbulence emanating 
from damage on the wind-side could raise the heating levels in the region of any damage 
on the leeside. 

It is recommended that the CHT, BLT, and TMM teams perform sensitivity studies to 
assess the need for a leeside capability and provide some rationale for the engineering 
judgment that will necessarily be used for leeside damage should it occur. 
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6. Tile Gap Effects 

There is a concern that augmenting the local bump factor by a 20 percent uncertainty 
factor to account for tile gap effects on the cavity heating level is not sufficient. 
Historically, an adjustment on the local heating or tile thickness was used in regions with 
unfdled gaps to account for a possible impact on structural temperature levels. The 
concern is based on current arcjet experimental data presented in the Cavity Heating Tool 
documentation. The cavity heating data are presented for tests with and without tile gaps 
and show 14-48 percent increases in the heating factors due to the presence of a tile gap. 
Convincing arguments were presented concerning the credibility of the data and it is 
believed the low end of this range is more accurate. As a result of the questionable data, 
the cavity team recommended only a 20 percent increase in the bump factor for cavities 
in the presence of tile gaps. 

It is recommended that a properly designed test be conducted after RTF so the tile gap 
effect on cavity heating can be quantified. As the tools mature and the end-to-end 
conservatism is eliminated, the tile gap effect, as established by test, should be employed. 
Additionally, verification that that 20 percent uncertainty factor is included in the TMM 
for this configuration is required as part of the overall end-to-end validation. 

7. Pressure Gradient Effects 

There are no data for cavities in regions with pressure gradients. A 50 percent 
uncertainty was arbitrarily added based on engineering judgment to regions with high 
pressure gradients, but there is no rationale given for choosing a value of 50 percent. 
Engineering analysis to support this uncertainty factor was not presented. 

It is recommended that before RTF, CFD results should be used to detennine a value of 
the correction factor and the threshold value of the pressure gradient for which it is 
applicable. In the longer term, further analysis, testing, and/or CFD results are needed to 
quantify heating bump factors and uncertainties as functions of pressure gradient, body 
location, and free stream conditions. This objective should be added to the planned 
follow-on development testing to address crossflow and cavity shape effects. 

It is further recommended that if cavity heating data are needed in a region with a 
pressure gradient during STS- 1 14, that the heating bump factor be determined manually, 
using CFD solutions if at all feasible. 
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The following two recommendations address end-to-end validation arising from the CHT peer- 

review. 

8. Application of CHT Bump Factors into the TMM 

A great deal of time and discussion during the CHT peer-review focused on the correct 
way to apply the bump factor obtained from the CHT to the TMM. As a result of a 
conversation with Boeing/Huntington Beach and previous interactions with the CHT 
development team, the NESC Cavity Heating Tool Peer-Review team has formed a rough 
understanding as to how the TMM manages the surface energy balance. If this 
understanding is correct, then applying the bump factor to the heating rate, interpolated 
from four surface temperature values, is an acceptable approach. Further investigation is 
required to conclusively address implementation issues regarding exactly how the CHT 
augmentation factors are used in concert with the baseline heating in the TMM. 

It is recommended that an explanation from someone familiar with the TMM explain 
how the TMM solves the surface energy balance and how it uses the bump factors within 
this energy balance be provided. A simple sample solution would also be of great value. 
There is no need to take the process completely from the cavity wind tunnel data through 
the TMM calculations. Starting with a set of bump factors and applying them to the 
heating problem will be more than sufficient. Additionally, this should address the 
application of the catalytic heating factors and verify which emissivity values are being 
used and that they are consistent throughout the process. This should be provided as part 
of the end-to-end validation exercise. 

9, Reliance on 50/50 “Rule” to Establish Cavity Depth 

The cavity modeling team is given this rule of thumb to establish cavity depth in an 
automated fashion. This “rule” appears to be one that has been developed outside the 
purview of the CHT, but its application contributes to the geometric definition of the 
cavity, critical to the thennal analysis. There is no documentation of this rule within the 
CHT material and its genesis was unclear to the peer-review team. Note: the rule is 
established in the Tile Repair Project Analysis Tools Requirements document. The rule 
appears to effectively “smear” all remaining material on the cavity floor over the entire 
area of the cavity floor. It also appears that the 50/50 rule may be applied regardless of 
the size of the cavity. For a small cavity, the 50/50 rule is likely of little or no 
consequence. However, as the cavity size grows there could conceivably be a large area 
of minimally protected structure. It was not clear that there were any bounds associated 
with the 50/50 rule, beyond which human intervention would be required. Application 
of this simplification must be applied with caution as it affects the cavity dimensions, 
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which has a direct effect on the CHT augmentation factors and will be a first order effect 
in the TMM results. 

It is recommended that the 50/50 rule be utilized as first cut, with an established depth (or 
height of floor material) below which a flag will automatically be set to require 
intervention in the cavity modeling to accommodate this type of situation. Similarly, 
establish a maximum cavity area above which a flag would be set to require intervention. 
All cavity models should be reviewed by the combined engineering team including 
membership from the CHT, BLT, TMM, and CATIA modeling teams and compared with 
the actual damage in establishing the cavity dimensions based on this rule. 
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C.6 CFD FOR CAVITY HEATING: SMOOTH BASELINE 
C.6.1 Function(s) of Tool 

The Shuttle RTF provided a natural extension for application of high-fidelity Computational 
Fluid Dynamic (CFD) tools, not only to develop a comprehensive laminar, aerothermal database 
for the smooth configuration of the Orbiter, but also to investigate and assess the vehicle health 
effects for various types of TPS damage and proposed on-orbit repair strategies. In support of 
these activities, the establishment of an aerothermal database of laminar, real-gas Navier-Stokes 
CFD solutions that span a range of Orbiter entry flight conditions has been completed. The 
Smooth OML Aerothermal Solution Database (SOASD) is an essential resource for nominal 
(Smooth OML) pressure, heating particularly the boundary layer state information. The 
comprehensive set of aerothermal data provided includes not only surface pressures, shear 
forces, temperatures and heat fluxes, but also other quantities such as the fluid dynamic (e.g., 
edge Mach number) and thermochemical state of the flow at the boundary layer edge, and 
integral boundary layer parameters such as displacement and momentum thickness. The latter 
parameters are of use in detennining, in an engineering sense, the onset of transition of the wall- 
bounded shear layer from laminar to turbulent. All of these required data are detennined a 
posteriori from the computed CFD solutions. 

The high-level inputs for the SOASD tool are the location and geometry of TPS damage or 
repair, and the flight Mach, Reynolds number and angle-of-attack. The tool then outputs the 
local conditions at each damage/repair site. These include the reference heat flux, temperature, 
pressure, and boundary layer parameters for use by the Cavity Heating Tool (CHT) and the 
Boundary Layer Transition (BLT) Prediction Tool. The SOASD is to be used pre-flight in 
support of damage tolerance assessment activities, historical data reconstruction (e.g. Platinum 
dataset activities), and the establishment of the 3”/l” imaging requirements verification. For 
real-time on-orbit mission support, the tool is used to assist in an informed damage disposition 
decision. The SOASD provides direct input to CHT and BLT Tools for Damage Assessment 
Team analyses. Additionally, it is foreseen that the CFD Process/Tools can be used to augment 
data and information available. This last application is not currently considered as part of the 
critical/primary path. 

It should be noted that prior to STS- 107, no previous detailed comprehensive CFD aerothermal 
analysis database for Orbiter entry flight conditions existed. The new SOASD represent the best 
efforts (state-of-the-art) calculations of accurate Orbiter entry flow-fields. The CFD analysis 
tools used in the study are the DPLR code from NASA Ames Research Center and the LAURA 
code from NASA Langley Research Center. Both codes represent modem implementations and 
methodologies for application to real-gas Navier-Stokes calculations. The two codes are 
applicable to both viscous, compressible, ideal-gas (tunnel conditions) and real-gas (chemically 
non-equilibrium, high enthalpy - flight condition) flows. 
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Damage Assessment Tools Using the CFD Smooth Baseline Database 

This database is a resource directly needed by two primary TPS damage assessment tools that are 
to be used during all future flights in the event of observed damage. The first is the CHT which 
serves as the primary predictor of local heating augmentation within and around any observed 
tile damage. The CHT relies primarily on a large database of wind tunnel cavity heating 
experiments to establish predicted heating for a cavity based on boundary layer parameters 
(boundary layer thickness, edge Mach number and Reynolds number based on momentum 
thickness). To relate a particular damage observed on-orbit to the database of experimentally 
observed heating, boundary layer parameters are used by the CHT to perfonn the mapping. Thus, 
essential inputs to the CHT are the boundary layer parameters over the tile acreage region of the 
Orbiter OML as a function of the entry trajectory that the SOASD provides. 

The BLT Tool will also be used during future Shuttle flights in the event of observed Orbiter 
TPS anomalies. The purpose of the BLT Tool is to predict, for an observed surface perturbation, 
the time during entry when the onset of transition to turbulence occurs as well as the extent 
(area) of the transition. Early transition to turbulence, experienced at sensitive locations on the 
Orbiter, produces extreme heating and may have catastrophic consequences. As in the case of the 
CHT, critical inputs to the BLT Tool are the boundary layer parameters as functions of entry 
trajectory and OML location. The SOASD provides this boundary layer in formation - 
particularly at the higher Mach numbers experienced during nominal peak heating. 

C.6.2 Assumptions and Limitations 

Several key assumptions have been made during the development of the SOASD. 

1. The tool utilizes a set of 15 CFD solutions at points in Reynolds No-Mach space along a 
nominal Orbiter entry trajectory. Additional CFD solutions at off-nominal angle-of- 
attack solutions are provided at each trajectory point. It is assumed that this adequately 
captures the required variations necessary for the downstream (CHT & BLT) tools. 

2. The CFD analysis tools utilized are based on the assumption that the flow is laminar, 
continuum mechanics is applicable, and the geometry is very close to that characterized 
in the current Orbiter CAD model. 

3. For the application of the results of these calculations, it is assumed that the accuracies 
and uncertainties for boundary layer parameters at flight conditions are consistent with 
quantified accuracies and uncertainties for boundary layer parameters at tunnel conditions 
and heat-rate values at flight conditions. 
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4. For modeling efficiency, the entire Orbiter is modeled with the boundary conditions of a 
uniform RCG surface coated and non-heat conducting surfaces. This is assumed 
adequate to capture acreage wind-side tile parameters of interest. 

5. It is assumed that the grid resolution, numerical models, physics models, and surface 
characterization adequately replicate Orbiter entry conditions. 


Several key limitations have been noted in the development of the SOASD. 

6. The database is intended for tile TPS application and the products from the database will 
only be used to determine aero, aerothermal and boundary layer parameters for smooth 
OML wind-side RCG tile acreage regions. 

7. The SOASD is specifically not to be used for locations on or very near the WLEs, the 
nose cone or the leeside. 

8. As noted in the assumptions, the products from the database are only applicable for the 
Orbiter under laminar flow conditions. 

9. The products from the database will only be used for the Orbiter under conditions in 
which the flight parameters match those represented along the nominal entry corridor 
covered by the Reynolds Number - Mach, angle-of-attack space captured in the 
computations. 

10. The products from the database must be used with the full understanding and acceptance 
of the quoted parameter based uncertainties. In particular flight boundary layer quantities, 
such as the boundary layer thickness, will be used with the accepted risk of the lack of 
substantial validation of defensible uncertainties, (i.e., no direct comparison of boundary 
layer thickness measurements - flight or ground test - and SOASD predictions are 
available). 

Several uncertainty sources contribute to the overall prediction accuracy contained in the 

SOASD. 

1 1 . CFD analysis solutions rely on proper grid resolution and quality as well as proper 
physical and numerical modeling. The calculations provided in the SOASD have been 
assessed for these uncertainty levels and documented. The accuracy and validation of the 
tool have been established by comparison of predictions of boundary layer properties at 
wind tunnel conditions. Traceability to flight is accomplished by comparison of flight 
heating rate data with the CFD analysis predictions. These fonn the basis for the 
validation of the SOASD predictions of boundary layer properties at flight conditions. 
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12. The flight data and tunnel experimental data both include uncertainties which are not 
accounted for in the comparisons. 

13. The lack of high enthalpy boundary layer experimental data for direct comparisons 
requires the acceptance of an unquantified uncertainty in the flight predictions. 

C.6.3 Observations 

1 . An independent Peer-Review Panel was established by the tool developers and 
augmented with NESC designees. The group was chartered to assess the SOASD tool 
readiness for supporting STS-1 14 RTF. The peer-review team’s assessment is that the 
SOASD can be used to support STS-1 14 for damaged TPS assessment with the accepted 
risk of recognized limitations to the application and validity of the tool. The major 
findings of the peer-review team have been reported to the OPO. The NESC reviewers 
concur with these findings. 

2. These major observations can be summarized in two primary findings. The first is in 
regards to the flight boundary layer thickness predictions. As noted previously, 
validation of the accuracy of boundary layer thickness predictions at flight conditions is 
based on comparisons at wind tunnel conditions and comparison of flight heat rate 
values. Therefore, the predicted boundary layer thickness at flight conditions in the 
SOADB does not have direct quantitative support for validation. Comparisons with 
flight data for heating rate and pressures are considered very good and suggest that the 
BLT predictions are relatively accurate for the regions of SOASDB applicability. 
Confirming the validity of this assumption is remaining open work. The NESC supports 
the pursuit of experimental boundary layer data at high-enthalpy, flight-like conditions, to 
improve validation rigor 

3. The initial report did not adequately address comprehensive uncertainty quantification 
and did not give adequate treatment to the separation of uncertainty contributors 
including: numerical, physical model, geometric, post processing, experimental 
(instrumentation) and inherent system uncertainty. It was recommended that the report 
should also document uncertainty bias and maximum deviation. This has been addressed 
in an updated version of the documentation. 

C.6.4 Recommendations 

The SOASD Peer-Review highlighted a couple of major findings and has provided specific 

recommendations to address each. Many of these findings address the recognized assumptions, 

limitations and uncertainty factors addressed in Section C.6.2. The following recommendations 

have been developed from this peer-review regarding the SOASD. 
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1. Flight Boundary Layer Thickness 

The boundary layer thickness accuracies and uncertainties at flight conditions in the 
SOASD are reliably correlated to accuracies and uncertainties of heating at flight 
conditions and boundary layer thicknesses at tunnel conditions. Validating the accuracy 
of boundary layer thickness predictions at flight conditions, based solely on these 
comparisons, is not well supported. As a result, the predicted boundary layer thickness at 
flight conditions presented in the CFD For Cavity Heating documentation does not have a 
quantitative support for validation and represents a significant assumption for the tool. It 
was recommended that further assessment of the validity of this assumption should occur 
as follow-on work that examines the relationship between 8, Re, M e , T e , T w , Pr and 

y through unit CFD tests for flat plates with and without high enthalpy. This should also 
be for the unit CFD tests for the Orbiter configuration at flight conditions to quantify the 
sensitivities of the solutions to various parameters. However, it is anticipated that hard 
validation of the boundary layer thickness at flight conditions will not be possible without 
high enthalpy experimental data. Therefore, it is also recommended that the possibility 
of obtaining high quality experimental validation data from a ground test facility for high 
enthalpy boundary layer thickness predictions be studied. If an experimental test proves 
feasible (i.e., considering resource and time constraints), such tests shall be performed to 
survey the boundary layer thickness at high enthalpy conditions. It should be noted that 
the need for this data was recognized by the OPO, which requested that a delta-funding 
requirement and test strategy be submitted for consideration. 

2. Comprehensive Uncertainty Quantification 

The CFD for Cavity Heating documentation did not adequately address comprehensive 
uncertainty quantification. The report did not give adequate treatment to the separation 
of uncertainty contributors including: numerical uncertainty (e.g. truncation error or mesh 
resolution, scheme accuracy, and convergence accuracy), physical model uncertainty 
(e.g. chemistry models, real-gas transport models, surface properties), geometric 
uncertainty (e.g. geometry accuracy), post processing uncertainty (e.g. calculation of the 
boundary layer edge location), experimental or instrumentation uncertainty, and inherent 
system uncertainty. It was recommended that the report address the above parameters 
and document uncertainty bias and maximum deviation in addition to the standard 
deviation. Much of this work has been completed and included in updated 
documentation provided to the peer-review team. 

3. Clear Assumptions, Objectives and Limitations 

Greater clarity on the assumptions are being made. The objectives/purpose of the 
database and the limitation/restrictions of the database should be included in the 
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documentation. This has been completed and included in updated documentation 
provided to the peer-review team. 

4. Other Issues, etc. 

One reviewer noted confusion on the methodology for calculating the boundary layer 
edge. Additional descriptions shall be added to clarify the methodology. It is noted that 
the BLAYER utility calculates along gridlines and not an interpolated normal axis. An 
attempt will be made to calculate the orthogonality of these lines. 

Instrumentation uncertainty is not quantified in the boundary layer report and thus cannot 
be properly addressed. However, a bit more discussion on this topic should be added. 
The added discussion should address the issue of why different methods were tried for 
the computation of tunnel free stream conditions. 

Discussion needs to be added that describes the differences between the LAURA and 
DPLR implementation of the physical models, and how it is an exercise for future study 
to try and get the physical models precisely the same between the two codes. The 
chemical non-equilibrium portions of the two codes contain enormously complicated and 
extensive models to account for the non-ideal gas effects. Ensuring that these are done 
precisely the same in both codes would take a very long time. Also, the numerical 
dissipation schemes for the two codes are quite different making exact code verification 
studies impossible. 
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C.7 CFD FOR CAVITY HEATING: FLIGHT TRACEABILITY 
C.7.1 Function(s) of Tool 

Flight Traceability is intended as a supporting study for the tile cavity heating tool (refer to 
Appendix C.5). The tile cavity heating tool is to serve as the primary predictor of local heating 
augmentation that occurs within and around any observed tile damage. The heating augmentation 
products of the tile CFIT, in turn, feed the tile thermal and structural assessment tools to analyze 
the impacts of any change in heating on the health of the Orbiter TPS. A noteworthy aspect of 
the CHT implementation is that the derived laminar flow cavity heating bump factors it provides 
are based entirely on low-enthalpy, ideal-gas, and wind-tunnel experiments. The mapping of this 
experimental database of cavity heating results is performed via the CHT by directly relating 
boundary layer parameters at tunnel conditions to those at flight. The obvious concern is that 
heating bump-factors at high-enthalpy real-gas flight conditions will not correlate to boundary 
layer parameters in an identical manner as they do at tunnel conditions. The implication is that 
the heating bump factors predicted by the CHT might either over or under estimate the actual 
heating. The Flight Traceability results are not intended to form a basis for determining the 
heating bump factors for a given cavity damage assessment on-orbit. Instead, the CFD study is 
simply a supporting effort, giving greater insight for the correlation of heating bump factors 
occurring at flight conditions. 

Under the current study, CFD solutions for tile cavities are computed at both wind tunnel and 
flight conditions to understand the cavity heating bump factor relationships between the two. The 
study considers only laminar flows on rectangular cavities that are aligned with the flow. At the 
present, the CHT (version 2) also idealizes all cavities as rectangular. Again, the objective of the 
study is not to develop a comprehensive local heating CFD prediction database for Orbiter tile 
cavities, but to develop supporting evidence for the relationship between tunnel heating bump 
factors and flight heating bump factors for equivalent tile cavities. 

The NESC peer-review has been completed and the results presented to the tool developers and 
SSP. However, the formal documentation of the peer-review is not complete as of the release 
date of this report. A separate report, "Inspection of the Math Model Tools for On-orbit 
Assessment of Impact Damage", will be prepared by the NESC that fully documents all of the 
tool peer-reviews. 
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C.8 CATALYTIC HEATING TOOL: DAMAGED 

C.8.1 Function(s) of the Tool 

1 . For the hyper velocity entry of the Orbiter, the KE of the air molecules processed by the 
Orbiter bow shock relaxes into other energy modes, such as chemical and thermal energy. 
The high temperatures associated with this conversion of KE into chemical and thermal 
energy cause the air molecules to dissociate into their constituent atoms absorbing large 
amounts of the total available energy. When these atoms recombine into stable molecules 
at the surface of the vehicle, due to catalytic effects, the latent dissociation energy is 
released producing increased heating levels to the thermal protection system (TPS). 

2. Different TPS surface materials can have different surface catalytic properties and can 
modify the rate at which these catalytic reactions take place. For example, because of 
increased surface catalycity, the surface heat rate will be correspondingly increased. The 
Catalytic Heating Tool (CHFT) provides these augmentation factors as enthalpy- 
dependent laminar heating augmentation factors for the damaged TPS Bare Tile and RCC 
substrate as well as the proposed TPS repair materials. Specifically, these are catalytic 
augmentation factors for uncoated tiles (LI-900, LI-2200, and FRCI-12), tile repair 
materials (emissivity wash and STA-54), damaged reinforced carbon-carbon (RCC) 
substrate, and RCC repair materials (NOAX - RCC Crack repair material, MCM-700 
coated CSiC - RCC Plug repair material). The CHFT is used both for pre-flight damage 
tolerance and in-flight damage/repair assessments. 

3. The catalytic heating augmentation factors defined are applied as follows: 

Final Local Heating = Catalytic Heating Augmentation Factor* Baseline Heating 

The development of these catalytic heating factors is based on arcjet test data from 
NASA ARC and JSC facilities. The basic approach was to determine maximum 
augmentation factors relative to heating for healthy (undamaged) coated tile and RCC. 
Damaged, uncoated RCC catalytic heating factors were developed using analyses that are 
validated by tile OEX flight data (STS-2, 3 and 5), and then verified by limited RCC 
arcjet data. The variation of factors with flight conditions was based on the OEX flight 
measurements on tiles that were coated with a highly catalytic material. 

4. Several enhancements are provided by the CHFT. Previously, catalytic heating data for 
damaged, bare tiles were not available and the heating was assumed to be the same as the 
heating on healthy Reaction Cured Glass (RCG)-coated tiles. Data are now available to 
support this assumption. Additionally, analytical tools and limited test data are now 
available to quantify catalytic heating to damaged uncoated RCC and some candidate 
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RCC repair materials. However, data for the tile repair material, STA-54, does not yet 
exist (testing is planned). 

5. Other factors that can affect the heating, such as damage geometry, are accounted for in 
other tools. The catalytic heating augmentation factor applies to the change in heat flux 
due to the change in catalytic recombination rates of the oxygen and nitrogen. Since the 
nominal (undamaged) material on the tile surfaces of the Orbiter is RCG, the black 
coating on the windward TPS tiles, the catalytic heating factor of other TPS, and TPS 
repair materials are given as a ratio to the RCG heat rate. 

C.8.2 Assumptions and Limitations (and Uncertainties) 

Several key assumptions were made during the development of the CHFT. 

1 . Foremost among these is that the arcjet data bound (place an upper limit on) the catalytic 
heating effect, and that the resulting heating factors can be scaled to flight. This flight 
extrapolation depends on assuming that the variation with total enthalpy of the catalytic 
heating factor is the same as that derived from the catalytic tile effects flight experiments 
on the OEX flights (STS-2, 3, and 5). In deriving the catalytic heating factors, an 
assumption regarding emissivity is required to adjust the radiative heating in the energy 
balance. 

2. This assumption has a direct effect on the catalytic results. For the CHFT development, 
the nominal emissivity values were used by the Thermal Group in this data analysis. 

3. There is limited available arcjet data to use as the basis for some catalytic heating factors 
(Bare LI-900: Two test poin ts - 1600 F & 1800 F on RCG; Bare FRCI-12 and LI-2200: 
Two test points - 2000 F and 2300 F on RCG; Emittance Wash: Four test points - 1600, 
1800, 2000 and 2300 F on RCG). 

A few key limitations have been noted in the development of the CHFT for windward surface 

tiles, RCC surfaces, and to other materials tested. 

1 . The CHFT provides enthalpy-dependent heating augmentation factors for damage and 
repair materials for the laminar portion of the flight trajectory. 

2. Turbulent factors are ignored. 

3. The CHFT results are simplistic; and bounding heating factors are based on limited test 
data. As such, they should be considered as preliminary. 

Sources of uncertainty that contribute to CHFT overall prediction accuracy have been identified. 
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4. As stated, the catalytic heating factors were developed by bounding available data. 
Additionally, any uncertainty in emittance values directly affects the analysis of arcjet 
test data and values derived from these data. 

5. Emittance is typically difficult to determine, even to define. It directly affects the 
uncertainties in catalycity. Most importantly, the end-to-end analysis must use same 
emittance for flight predictions. For bare tiles, the emittance can be particularly difficult 
to define. Bare tiles are volume emitters, therefore, radiation comes from inside as well 
from the tile surface, however, the tiles are modeled with surface emittance only. The 
effect of neglecting the volume emittance of the tiles has not been quantified. 

C.8.3 Observations 

1. The NESC peer-review team’s assessment is that the CHFT (augmentation factor 
approach) can be used on STS- 1 14 for damaged TPS with the accepted risk of recognized 
limitations, some significant, to the application and validity of the tool. 

2. Catalytic factors for damaged TPS (bare tile and RCC substrate) are based on the limited 
available testing. However, the analysis is acceptable for application on STS-1 14. The 
TPS bare tile assumptions and results appear reasonable and bounding. The 
bare/damaged RCC substrate also appears bounding. It should be noted that catalysis of 
reacting surfaces, e.g. bare RCC, may be a misnomer and referring to this as fully 
catalytic heating might be an invalid concept. 

3. It is more accurate to call this "augmented heating" since the process includes oxidation, 
combustion, mass injection, catalysis, etc., that occurs with "bare RCC". 

4. The catalytic factors for TPS repair (STA-54, RCC crack & plug, emittance wash) are 
based on limited and incomplete arcjet test data. The tile emittance wash and RCC crack 
repair catalytic factors are based on limited available arcjet test data and are reasonable 
and bounding. The analysis is acceptable for application on STS-1 14. 

5. For the tile repair material, STA-54, a good catalytic factor based on engineering data is 
not available. This is further compounded by lack of thermal property data. Therefore, 
no credible uncertainty analysis exists and the use of the present CHFT factors are 
suspect. 

6. For the RCC plug repair material, an average catalytic factor based on arcjet test data 
does not address the split line effects (boundary between plug and RCC), which could 
result in local increased heating. This potential increase in heating at the split line 
requires further assessment. 

7. The nominal emittance assumption is a significant limitation to establishing the catalytic 
factors. Emittance is a major parameter in the energy balance equation that is used to 
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estimate the catalytic factor. The lack of accurate emittance data will drive catalytic 
factor uncertainties. The determination and use of emittance is one of the critical end-to- 
end analysis validation topics that must be addressed. 

C.8.4 Recommendations 

The CHFT peer-review has highlighted several major findings and has provided specific 
recommendations to address each. Many of these findings address the recognized assumptions, 
limitations, and uncertainty factors addressed in Section C.8.2. The following recommendations 
have been developed out of this peer-review regarding the CHFT. 

1. Future Enhancements 

Recommendations for continuing development of the CHFT were presented at the OCCB 
and recognized by the OPO, which requested that a delta-funding requirement be 
submitted for consideration. The NESC concurs with this course of action. 

Enhancements to consider should include replacing bounding factors with an engineering 
method of modeling catalytic heating as a function of surface temperature and of re- 
entry-gas energy-state. The characterization of STA-54 in arcjet tests should be 
completed. The catalycity and emittance of RCC repair materials should be measured. 
The emittance assumptions for other materials must be reviewed and updated as required. 

2. Emittance 

The development of the CHFT revealed that a major uncertainty in the catalytic heating 
effects stems from uncertainty in the emittance of the materials. Any uncertainty in 
emittance values directly affect the analysis of arcjet test data and values derived from 
these data. Emittance is typically difficult to determine. For bare tile, emittance can be 
particularly difficult to define. Bare tiles are translucent; therefore, radiation comes from 
inside as well as from surface of tile. Most importantly, the end-to-end analysis must use 
the same emittance for flight predictions. It is recommended that the emittance values 
used throughout the analysis by the CHFT, the TPS Thermal Math Models, and other 
associated models be verified as the same values. Additionally, it is recommended that 
additional test and analyses be conducted to improve confidence in emittance values for 
uncoated tiles. 

3. Split Line Effects 

The magnitude of the heating increase at the split line between coated RCC and the repair 
plug, and the resulting effect from the thermal analysis needs to be addressed. (Actually, 
the increase in heating at material split lines is a problem to some degree for most of the 
materials with different catalycity covered in the CHFT). However, the critical nature of 
the plug performance installed in the RCC is of primary concern. For the RCC plug 
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repair material, an average catalytic factor based on arcjet test data does not address these 
split line effects (boundary between plug and RCC), which could result in local increased 
effects. Prior to utilization of on-orbit repair materials for RCC, this potential increase in 
heating at the split line requires further assessment, including the estimates of the stated 
average catalytic factor. 

4. Bare RCC Catalysis 

Catalysis of reacting surfaces, e.g. bare RCC, may be a misnomer and referring to this as 
fully catalytic heating might be an invalid concept. The RCC substrate surface oxidizes, 
rather than promotes recombination of oxygen atoms. Surface reactions with nitrogen 
atoms are not addressed; and they are assumed essentially to be fully catalytic. As 
previously noted, it is more accurate to call this "augmented heating" since the process is 
essentially a coupling of gas physics and surface (bare RCC) physics phenomena. Two 
offsetting factors led the analysts to recommend assuming fully catalytic heating on bare 
RCC. Bare RCC oxidizes at entry conditions leading to increased heating due to the 
addition of heat of combustion. However, ablation or erosion of the surface tends to 
reduce the heating by blowing effects. A catalytic heating factor cannot rigorously 
consider these opposing effects, particularly since the factor includes an effect of 
discontinuous surface catalysis. However, due to the overall uncertainties, this 
approximation seems reasonable. It is recommended that this phenomenon be 
investigated further by measuring the heat flux to bare RCC in pure nitrogen, as well as 
an inert gas (argon) to discriminate between catalytic reactions from other reactions on 
the surface, and thus to identify actual catalytic heating factors. 
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C.9 BOUNDARY LAYER TRANSITION (BLT) PREDICTION TOOL 
C.9.1 Function(s) of Tool 

1 . BLT from laminar to turbulent flow conditions results in a marked increase in surface 
heating to the Orbiter during re-entry flight. Damage from ascent impacts could result in 
conditions that promote early or asymmetric transition. The objective of the BLT 
Prediction Tool is to predict BLT time during re-entry based on damage and/or TPS 
repair information. High level inputs required to make the BLT time assessment include 
up-to-date trajectory infonnation, detailed and accurate dimensions of the critical damage 
sites, and any repair concepts that are available. The BLT Prediction Tool provides a 
transition time or Mach number for output. 

2. The BLT Prediction Tool can be used prior to entry to provide a prediction of transition 
onset, based on updated BLT correlation results, using flight trajectory and OML 
damage/repair information as inputs. The results of the BLT predictions are then used to 
assist the disposition decisions regarding which damage sites require further assessment, 
(e.g. a damage site downstream of a more forward damage site could be flagged for 
further assessment, if BLT predictions indicate the forward damage site would promote 
transition to turbulent flow). 

3. The BLT Prediction Tool approach is based on a Fortran program that includes a 
database of computed boundary layer parameters that cover a range of nominal 
trajectories for entry and utilizes an interpolation tool to extract specific local properties 
used to predict the boundary layer state during the mission trajectory. The interpolation 
tool accesses a database of boundary layer conditions based on analytical predictions. 
Currently, a BLT threshold of Mach 18 is assumed, along with a higher uncertainty for 
the initial flights. This will be assumed until new detailed information can be obtained to 
further refine the use of ground-based methodology for flight above this historical 
observed limit for early Orbiter BLT. 

The NESC peer-review has been completed and the results presented to the tool developers and 
SSP. However, the formal documentation of the peer-review is not complete as of the release 
date of this report. A separate report, "Inspection of the Math Model Tools for On-orbit 
Assessment of Impact Damage", will be prepared by the NESC that fully documents all of the 
tool peer-reviews. 
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C.10 3D ACREAGE TILE THERMAL MODEL 
C.10.1 Function(s) of Tool 

The TMM was developed to aid in the assessment of damage sustained by the Orbiter TPS 
during ascent. The TMM predicts the temperature response of the Orbiter’ s lower surface 
acreage TPS materials and structure at damaged locations. Results from the model serve as input 
to the structural/stress tools for margin assessments. Once a damaged location is analyzed, the 
model will be used as supporting information with flight experience to determine whether the 
damage is acceptable to fly “as is” or if a repair is necessary before re-entry is attempted. 

C.10.2 Assumptions and Limitations 

1 . The TMM uses a constant thickness approach. A sensitivity analysis on this constant 
thickness approach was not performed. The thickness at the damaged location is used in 
the model, but no data was presented showing how the thickness varied over an analyzed 
location. 

2. Cavity (damaged) heating augmentation factors were considered “out of scope” for the 
thennal reviewers. However, several items that would affect the augmentation factor 
were listed are still under investigation. These items include surface catalytic factors, gap 
heating inside cavity, porosity/permeability characteristic of uncoated silica, emittance of 
bare tile, and glazing and melting of RSI and wonnholes. 

3. Thermal model is just one component in the overall assessment. Considering that several 
items were considered “out of scope” for the thermal team, it was not clear how all 
reviews (stress, aeroheating, etc.) are being coordinated to ensure the integrated product 
is adequate (ensuring consistency between inputs and outputs). 

C.10.3 Observations 

1 . Tile De-bonding in Flight Data Comparisons 

The fact that the model predicted tile de-bonding in flight data comparisons when de- 
bonding did not occur is a cause for concern. Boeing is updating the stress tool used to 
evaluate bondline integrity and will verify/validate the new tool. The thennal review 
team did not receive any information on how the thermal data is used by the stress tool to 
evaluate margin assessments. As such, we did not examine how the temperature data 
from the thermal TMM (which uses a constant thickness approach) is mapped onto the 
structural math models. 
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1 . Damage Location to Flight Data Comparison 

A survey of historical tile damage to the Shuttle was performed and selected cases were 
evaluated. No temperature data was available (flight instrumentation) to compare TMM 
temperature results for these analyzed cases. Results for the three locations analyzed 
using the 3-D TMM indicated RTV bond failure limits would be exceeded in ah but one 
case. Post- flight examination of the damaged sites revealed that tile loss did not occur. 
The thermal tool identifies how much of the tile/SIP bondline exceeds the bond failure 
criteria (RTV bond failure criteria requires that 50 percent of the tile RTV-560 footprint 
exceeds 625°F). Tile loss is highly dependent on flight load cases. To address this issue, 
Boeing is developing a new stress tool (to be embedded in the 3-D TMM). The stress 
tool identifies forces on the tile from flight loads and using the temperature data 
determines if de -bonding will occur. 

2. Uncertainty of Uncoated (Damaged) Tile Area Flemispherical Emittance 

During the STS- 107 investigation, M&P recommended using the TPSX database for 
uncoated tile emissivity values. TPSX data are theoretical projections based on room 
temperature measurements. TPSX tile emissivity data are significantly lower (at high 
temperatures) than previous values used in Boeing thermal models. Thus, TPSX data 
predicted conservative tile temperatures. Arcjet tests were performed at JSC to evaluate 
bare tile emissivity in the 2800°F range to assess this tile property change. Based on test 
data, M&P recommended continuing to use the TPSX data. For LI-2200, the TPSX data 
is lower than test data but this is not the case for LI-900 (test data is lower than TPSX - 
potentially non-conservative). Damaged tile has different surface properties (i.e., 
roughness, glazing, etc.) than pristine arcjet test samples and could result in different 
emissivity values than TPSX. Boeing stated that no sensitivity studies of emissivity have 
been performed to understand the criticality of this assumption. 

3. Inter-Tile Gap Heating 

The 3-D TMM does not simulate the individual 6” x 6” Shuttle tiles and, thus, has no 
inter-tile gap heating in unfilled gaps. Gap heating is accounted for with a heating 
augmentation factor of 1.2. This augmentation factor is used in undamaged areas. The 
factor was identified using test data (Comparison of Orbiter STS-2 Development Flight 
Instrumentation Data with Thermal Math Model Prediction, 1982). In the past, the 
method used to account for gap heating was to apply a factor of 0.8 on the tile thickness 
(not on the heating). Boeing claimed that this new approach is equivalent and produces 
conservative results. 

C.10.4 Recommendations 

1 . Damage Location to Flight Data Comparison 
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Re-run more flight Platinum history dataset comparisons to determine if 3-D TMM (with 
new embedded stress tool) still predicts tile loss and compare temperature predictions 
against the forensic evidence confirming the integrity of the bond. 

2. Uncertainty of Uncoated (Damaged) Tile Area Hemispherical Emittance 

Perform an emissivity sensitivity analysis with 3-D TMM for various tile types, with 
guidance from M&P in defining uncertainty band to be used. If results show a high 
sensitivity, the Program needs to re-evaluate the use of the TPSX data. The Program 
should consider testing damaged tile (emissivity test) via a calorimetric thermal vacuum 
test of a tile sample. 

3. Inter-Tile Gap Heating 

Perfonn inter-tile gap heating sensitivity analysis and compare results with test data. 
Justify value used by calculating the ratio of model sidewall heating to surface heating. 
This will not be an exact number, but should serve as a rough confirmation of the value 
used. 
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C.ll SPECIAL CONFIGURATION THERMAL MODELS 
C.11.1 Elevon Lower Cove (EC) 3-D Thermal Math Model (TMM) 

C.ll. 1.1 Function(s) of Tool 

This model was developed to perform a thermal assessment of debris impact damage of the 
Elevon Lower Cove (EC) on flight specific missions and to provide entry temperature data for 
structural evaluation. The modeled area includes 56 percent Half Span (HS) - 77 percent HS of 
the EC. It extends one tile forward and aft in acreage areas, upward to the cove-closeout 
honeycomb panel and through the primary seal to the secondary seal curtain. The modeled area 
also includes the wing stub structure and TPS components between inboard and outboard 
elevons. 

C.ll. 1.2 Assumptions and Limitations 

1 . The TMM can be used as an approximation for other EC sections. However this 
capability has not been validated. Major differences in the EC as you move along the 
wing (inboard to outboard) include tile thickness, rub tube diameter, and hinge location. 
Boeing stated modifications could be made in the future to incorporate more of the 
elevon into the model. 

2. Flow past the primary and secondary seals is considered outside the scope of this TMM. 
If impact damage is extensive enough to create a flow path through the cove tiles and 
cause damage to the primary or secondary seals, it would automatically be considered as 
a case for repair. 

C.ll. 1.3 Observations 

1 . A formal test program was not established for the 3-D TMM. Validation is accomplished 
by comparison with flight data and to the predictions of the existing certified 2-D 
undamaged model. There is no 2-D damaged model. Direct one-to-one comparison 
between the 3-D TMM and both flight data and 2-D certified undamaged model is 
difficult due to thennocouple locations and configuration differences. Boeing stated that 
the 20°F/40°F flight verification criteria was imposed prior to having a full understanding 
of the substantial changes that some areas of the vehicle had undergone since flight data 
was collected. In some instances there have been changes made that cause temperatures 
to be different by much more than 40°F. FRCI-12 tile material was not available for the 
early flights but half of the elevon leading edge tiles are now FRCI-12. Earlier flights 
used different configurations for the cove closeout and had no thermal barrier covering 
the honeycomb panel. There was also no flow restrictor present between the carrier panel 
and seal retainer panel on STS-3 (source of flight data) 
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2. Several 3-D/2-D comparison plots violated the 20°F validation criteria. Boeing stated 
that these variations can be explained by EC configurations differences between the 
models. 

C. 11. 1.4 Recommendations 

1 . Perform arcjet testing for comparison with the model. 

2. Modify either the 2-D or 3-D TMM to more closely match configuration/property 
differences between models. 

3. Expand the 3-D model to include thermocouple locations (where available) from early 
flights. 
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C.11.2 Forward Reaction Control System (FRCS) Canopy 3-D TMM 
C. 11.2.1 Function(s) of Tool 

This model was developed to predict temperatures on the forward portion of the FRCS Canopy. 
The tool will be used to evaluate the temperature response of the TPS tile, RTV, SIP, thermal 
barrier and structure due to damage caused by debris impact. The modeled area extends aft and 
upward from the forward-most corner of the FRCS cavity seal for approximately eight tiles in 
both directions. 

C. 11.2.2 Assumptions and Limitations 

1. No internal FRCS components are modeled (i.e., thrusters, valves, tanks, lines, etc.). The 
current standard approach to flow path damage sites is to recommend repair. The 
capability to predict the temperature of internal components due to ingested air flow was 
not considered as part of the original task scope. Boeing stated that the model could be 
expanded to include these components. Similarly a breach beyond the thermal barrier 
could be simulated with model adjustments, but the accuracy of the predictions would be 
based on the capability to determine flow path impingement and heat rate deposition in 
the breach cavity. 

2. To model another area the TMM would need to be modified for tile type, tile thickness, 
and underlying structure at that particular location. The TMM can be modified but 
predictions would carry the caveat that the model has been modified and not validated for 
the location. 

C. 11.2.3 Observations 

1 . A formal test program was not established for the 3-D TMM. Validation is accomplished 
by comparison with the existing certified 2-D undamaged model. There is no damaged 
2-D model. No flight data is available for comparison. Due to differences between the 2- 
D and 3-D models, exact one-to-one comparison is not feasible. Therefore, comparisons 
are limited top surface nodes of the thermal barrier and tiles (considered as critical areas). 
Boeing stated that the lack of flight data was accepted by the technical community. 

C. 11.2.4 Recommendations 

1 . Perform arcjet testing for comparison with the model. 

2. Modify either the 2-D or 3-D TMM to more closely match configuration/property 
differences between models to either confirm or improve the TMM. 
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C.11.3 WLE Panel 9 Lower Access Panel (LAP) 3-D TMM 
C. 11.3.1 Lunction(s) of Tool 

This model was developed to perform a thermal assessment of the WLE LAP on flight-specific 
missions and to provide re-entry temperature data for structural evaluations of damage locations 
due to debris impact. The TMM is used to predict temperatures on the HRSI and FRCI tile, 

RTV, SIP, gap filler, horse collar, thermal barrier and supporting structure. The 3-D TMM 
models the LAP for Panel 9, an aluminum frame that is bolted to the lower attachment, internal 
insulation, and part of the RCC panel which is in contact with the horse collar, and one row of 
adjacent Orbiter acreage tiles. 

C. 11.3.2 Assumptions and Limitations 

1. The model does not include the T-seal between RCC panels. The T-seal is considered 
part of the WLE RCC model. 

2. The model can be used as an approximation for other LAPs, but mechanical differences 
must be well understood. Differences include tile thickness variations and different 
heating rates. Different panels will present similar trends, but different peak values. 
Management will be made aware that the model was modified to simulate an area that 
has not been validated. Therefore, the results will need to show more margins from 
allowable temperature limits than the area for which the model has been validated to 
make a repair/no-repair decision. 

C. 11.3.3 Observations 

1 . A formal test program was not established for the 3-D TMM. Validation is accomplished 
by comparison with flight data and to the predictions of the existing certified 2-D 
undamaged model. There is no 2-D damaged model. Direct one-to-one comparison 
between the 3-D TMM and both flight data and 2-D certified undamaged model is 
difficult due to thennocouple locations and configuration differences. 

2. The flight data comparisons show differences greater than the 20°F/40°F flight 
verification criteria. Boeing stated that the 20°F/40°F criteria became imposed prior to 
having a full understanding of the substantial changes that some areas of the vehicle had 
undergone since the flight data was collected. In some instances, there have been 
changes made that cause temperatures to be different by much more than 40°F. Model 
had to be compared to flight data that is only "near" the modeled area and does not truly 
represent the actual modeled location. 

3. The 3-D model over predicts flight data (similar profiles) while the 2-D under predicts 
flight data (not similar profiles). The 3-D model does not compare favorably to the 
certified 2-D model. The 3-D model compares better than 2-D for maximum temperature 
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comparisons. Boeing stated the 2-D model tends to under predict due to boundary 
assumptions. 

C. 11.3.4 Recommendations 

1 . Perform arcjet testing for comparison with the model. 

2. Modify the 2-D or 3-D TMM to more closely match configuration/property differences 
between models. 

3. Expand the 3-D model to include thermocouple locations (where available) from early 
flights to either confirm or improve the TMM. 
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C.11.4 Main Landing Gear Door (MLGD) 3-D TMM 

C. 11.4.1 Function(s) of Tool 

This model was developed to perform a thermal assessment of damage to the MLGD tiles. The 

TMM covers the forward 60 percent of the MLGD, the thermal barrier, and three surrounding 

rows of tiles. Critical components of the MLGD are the thermal barrier, pressure seal, RTV, 

SIP, and aluminum structure. 

C. 11.4.2 Limitations 

1 . Flow past the thermal barrier is considered outside the scope of this TMM. The sidewalls 

of tiles on either side of the thermal barrier slant away at approximately 45 degrees. As 
such, damage 0.3" deep that reaches within 0.3" of the surface edge is considered a 
penetration that would cause flow past the thermal barrier. Any flow past the thermal 
barrier that would impinge on the pressure seal would be repaired. 

C. 11.4.3 Observations 

1 . A formal test program was not established for the 3-D TMM. Validation is accomplished 
by comparison with flight data and to the predictions of the existing certified 2-D 
undamaged model. There is no 2-D damaged model. 

2. Direct one-to-one comparison between the 3-D TMM and both flight data and 2-D 
certified undamaged model is difficult due to thennocouple locations and configuration 
differences. 

3. The surface thermocouples temperature comparison with the 3-D TMM temperature 
predictions is conservative, but not so for skin thermocouple comparisons. Boeing stated 
that the predicted surface temperatures depend almost exclusively on heat flux input and 
emissivity. The over prediction of temperature at the surface is due to conservative heat 
flux data from the aeroheating subsystem. The temperature of the internal thermocouple 
trails the surface by about 500 seconds, and the cooling of the surface in the later stages 
of flight keeps the over predicted spike in temperature from impacting the aluminum skin 
temperature. 

4. The reason that the 3-D model predicts a lower temperature for the aluminum skin is that 
the honeycomb core of the door on OV-103 transmits more heat to the door interior than 
is transmitted by the unfilled void on OV-102 test data. 

C. 11.4.4 Recommendations 

1 . Perform arcjet testing for comparison with the model. 
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2. Modify either the 2-D or 3-D TMM to more closely match configuration/property 
differences between model 

3. Expand the 3-D model to include thermocouple locations (where available) from early 
flights to either confirm or improve the TMM. 


NESC Request No. 05-010-E 


@ 

NASA Engineering and Safety Center 
(NESC) Technical Assessment Report 

Document #: 

RP-05-82 

Version: 

1.0 

Title: 

NESC Peer-Review of the Flight Rationale for Expected 

Debris Report 

Page #: 

137 of 148 


C.11.5 Vertical Tail Leading Edge (VTLE) 3-D TMM 

C. 11. 5.1 Function(s) of Tool 

This model was developed to predict temperatures of the VTLE. The primary purpose of the 

tool is to evaluate the temperature response of the TPS tile, RTV, SIP and structure due to a 

debris impact. The model areas include 20 percent and 90 percent along the vertical tail span. 

C. 11.5.2 Assumptions and Limitations 

1 . Other areas of the VTLE are excluded from the TMM. The justification is that 
temperature results indicate the temperature profile is highest at the 90 percent location 
along the vertical span. 

2. If impact occurs at a location other than the 20 percent and 90 percent areas, the 90 
percent TMM is used to assess it for conservatism. If required, the model can be altered 
to reflect the damaged location. If this occurs, then additional margin as compared to 
allowable temperatures will be required to make repair/no-repair decisions. This 
capability is not validated and management would be made very aware that the model 
was being used outside of its original intended area. 

C. 11.5.3 Observations 

1 . A formal test program was not established for the 3-D TMM. 

2. Validation is accomplished by comparison with flight data and to the predictions of the 
existing certified 2-D undamaged model. 

3. There is no 2-D damaged model. 

4. Direct one-to-one comparison between the 3-D TMM and both flight data and 2-D 
certified undamaged model is difficult due to thennocouple locations and configuration 
differences. 

5. TMM (at 20 percent and 90 percent) correlated with flight data at the 30 percent and 80 
percent span location. Data presented shows flight data from the 80 percent span and 
TMM results from the 90 percent span. It is difficult to compare curves and highlight 
differences. Also, the flight data and TMM tile materials are not the same. 
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C. 11.5.4 Recommendations 

1 . Perform arcjet testing for comparison with the model. 

2. Modify either the 2-D or 3-D TMM to more closely match configuration/property 
differences between models. 

3. Expand the 3-D model to include thermocouple locations (where available) from early 
flights to either confirm or improve the TMM. 
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C.11.6 Forward Window # 3 Perimeter 3-D TMM 

C. 11. 6.1 Function(s) of Tool 

This model was developed to predict temperatures on the perimeter of the Forward Window #3 

Periphery. It is used to evaluate the temperature response of the TPS tile, RTV, SIP, thermal 

barrier and structure due to damage caused by debris impact. The modeled area covers four tiles 

along the Orbiter centerline lower corner of the Forward Window #3. 

C. 11.6.2 Assumptions and Limitations 

1 . Only four tiles modeled - other window periphery tiles may be analyzed with this model, 
but the configuration differences must be well understood. The modeled location was 
identified by the debris analysis team as a critical area. Boeing stated that there is a great 
deal of symmetry among the window periphery tiles so that the model can be adapted for 
other areas. Window configuration similarity is well understood. Management will be 
made aware that the model was modified to simulate an area that has not been validated, 
thus the results will need to show more margin from allowable temperature limits than 
the area for which the model has been validated to make a repair/no-repair decision. 

2. Breaches (caused by damage) beyond the thermal barrier can be simulated with model 
adjustments, but the accuracy of the predictions is based on the ability to define the flow 
path impingement and cavity heat rates. The current standard approach to flow path 
damage locations is to recommend repair. 

3. If damage is large enough to change the edge temperatures of the TMM (that is, TMM 
not sized properly), then a repair is recommended due to the criticality of the modeled 
location. 

C. 11.6.3 Observations 

1 . A formal test program was not established for the 3-D TMM. Validation is accomplished 
by comparison with flight data and predictions of the existing certified 2-D undamaged 
model. 

2. There is no 2-D damaged model. Direct one-to-one comparison between the 3-D TMM 
and both flight data and 2-D certified undamaged model is difficult due to thermocouple 
locations and configuration differences. 

3. Boeing stated that the V&V flight comparison criteria was adopted in advance of fully 
understanding some of the discrepancies the model would encounter relative to flight 
data. 

4. The 3-D TMM is built to current configuration data which differs from the original 
certified 2-D TMM. 
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C. 11.6.4 Recommendations 

1 . Perform arcjet testing for comparison with the model. 

2. Modify either the 2-D or 3-D TMM to more closely match configuration/property 
differences between models. 

3. Expand the 3-D model to include thermocouple locations (where available) from early 
flights to either confirm or improve the TMM. 
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C.11.7 External Tank Door (ETD) 3-D TMM 
C. 11. 7.1 Function(s) of Tool 

The 3-D TMM covers the ETD, thermal barrier, and two rows of surrounding tiles. It uses the 
effective structure thickness for the fuselage and the thickness from the 2-D certified model for 
the door. Hinges and latch fittings are not modeled. The TMM performs a thermal assessment 
of damage to the door tiles and two rows of adjacent tiles on the wing/fuselage. Critical 
components of the ETD include the thermal barrier, pressure seal, RTV, SIP and 
aluminum/beryllium structure. 

C. 11.7.2 Assumptions and Limitations 

1 . Model does not include the hinge and latch fittings and the effects of vent door 
convective cooling. 

2. Activation of the vent doors occurs at approximately 80,000 feet, at a velocity 
approximately 2400 feet/second and is continuous until landing. 

3. TMM results under predict flight data prior to vent door opening and then over predict 
flight data after vent door opening. 

4. The air temperatures at this altitude range from -90°F to -50°F. The model also uses a 
constant thickness for the door which in reality is not the case. 

C. 11.7.3 Observations 

1 . A formal test program was not established for the 3-D TMM. 

2. Validation is accomplished by comparison with flight data and the predictions of the 
existing certified 2-D undamaged model. 

3. There is no 2-D damaged model. 

4. Direct one-to-one comparison between the 3-D TMM and both flight data and 2-D 
certified undamaged model is difficult due to thennocouple locations and configuration 
differences. 

5. The flight data and 3-D TMM predicted results appear to be out of phase in the 
comparison plots. Boeing stated this “phase” difference is due to assumptions in the 
analytical aeroheating data. Specifically, the time peak heating and transition occurs. 


NESC Request No. 05-010-E 


@ 

NASA Engineering and Safety Center 
(NESC) Technical Assessment Report 

Document #: 

RP-05-82 

Version: 

1.0 

Title: 

NESC Peer-Review of the Flight Rationale for Expected 

Debris Report 

Page #: 

142 of 148 


C. 11.7.4 Recommendations 

1 . Perform arcjet testing for comparison with the model. 

2. Modify either the 2-D or 3-D TMM to more closely match configuration/property 
differences between models. 

3. Expand the 3-D model to include thermocouple locations (where available) from early 
flights to either confirm or improve the TMM. 
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C.11.8 Nose Landing Gear Door (NGLD) 3-D TMM 
C. 11. 8.1 Function(s) of Tool 

The NLGD 3-D SIND A TMM was developed to perform a thermal assessment of the NLGD on 
flight-specific missions and to provide entry temperature data for structural evaluations of 
damage due to debris impact. The 3-D TMM consists of the thermal barrier, one row of tiles 
adjacent to the thermal barrier, door acreage tiles, and aluminum structure. The model can 
predict re-entry temperatures and temperature profiles for the modeled components. 

C. 11.8.2 Assumptions and Limitations 

1 . The TMM results in the supplied package show a temperature violation for the Inconel 
flexible spring. Boeing stated that this violation was corrected with 3-D TMM 
modifications. Specifically the addition of AB3 12 fabric, AB3 12 cord and changes to the 
Inconel spring configuration (based on SDS drawings). 

2. The current temperature is 683° F which is well below the 1500° F temperature limit. 

The current temperature was reported in correspondence from Boeing personnel 
addressing model review questions. 

3. The aft half of the NLGD will be modeled prior to the next flight (entire door not 
modeled in current version) and will go through a similar V&V process. Therefore, this 
model can be considered a work in progress. 

C. 11.8.3 Observations 

1 . A formal test program was not established for the 3-D TMM. 

2. Validation is accomplished by comparison with flight data and to the predictions of the 
existing certified 2-D undamaged model. 

3. There is no 2-D damaged model. 

4. Direct one-to-one comparison between the 3-D TMM and both flight data and 2-D 
certified undamaged model is difficult due to thermocouple locations and configuration 
differences. 

5. The flight data and 3-D TMM predicted results comparisons appear to exceed the 20° 
F/40° F verification requirement. They do show similar profiles. Boeing replied that 
additional detail was added to the 3-D TMM since the review package was presented. 

6. Model modifications (AB3 12 cord and ceramic sleeving covering the Inconel springs) 
have resulted in temperature predictions closer to the 2-D TMM. Based on the Boeing 
reply (flight data comparison rather than 2-D/3-D comparison), it is not clear if the flight 
data comparison plots show 3-D or 2-D TMM predicted temperature profiles. 
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7. The 2-D and 3-D TMM predicted comparison plots also exceed the 20° F criteria. 

Current model predictions (not in package reviewed) show the maximum temperature of 
the hottest Inconel spring as 683° F. The RTV and pressure seal are 33° F colder, and the 
aluminum skin is 26° F colder in the 3-D model than in the 2-D model. All predicted 3-D 
component temperatures are within material temperature limits. 

8. Boeing stated that the differences between the 2-D and 3-D model predictions are well 
understood and result from material and configuration differences since the 2-D model 
was developed. 

9. Boeing also stated that large differences in the maximum temperatures are still evident in 
the results. This is contradictory to the previous explanation. 

C. 11.8.4 Recommendations 

1 . Perform arcjet testing for comparison with the model. 

2. Modify either the 2-D or 3-D TMM to more closely match configuration/property 
differences between models. 

3. Expand the 3-D model to include thermocouple locations (where available) from early 
flights to either confirm or improve the TMM. 
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C.12 TILE STRESS TOOL - RTV BOND LINE (45 DEGREES) 

The NESC peer-review has been completed and the results presented to the tool developers and 
SSP. However, the formal documentation of the peer-review is not complete as of the release 
date of this report. A separate report, "Inspection of the Math Model Tools for On-orbit 
Assessment of Impact Damage", will be prepared by the NESC that fully documents all of the 
tool peer-reviews. 
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C.13 STRESS ASSESSOR TOOL 

The NESC peer-review has been completed and the results presented to the tool developers and 
SSP. However, the formal documentation of the peer-review is not complete as of the release 
date of this report. A separate report, "Inspection of the Math Model Tools for On-orbit 
Assessment of Impact Damage", will be prepared by the NESC that fully documents all of the 
tool peer-reviews. 
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C.14 Assessment of End-to-End Tool Integration 

A limited peer-review of the end-to-end, integrated computational capability has been 
completed by the NESC, including the tool interfaces (data transfer) and correlation to 
historical flight data, and the tile tools that were cleared for use on STS-114. However, the 
current estimate of the level of uncertainty in the final computation of the damage severity 
(aluminum structure temperature, RTV bondline temperature, and structural margin of 
safety) is significant and may not allow any relief of the 1.4 FOS. 

The NESC peer-review has been completed and the results presented to the tool developers and 
SSP. However, the formal documentation of the peer-review is not complete as of the release 
date of this report. A separate report, "Inspection of the Math Model Tools for On-orbit 
Assessment of Impact Damage", will be prepared by the NESC that fully documents all of the 
tool peer-reviews. 
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